Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
wp-s2.exe

Overview

General Information

Sample name:wp-s2.exe
Analysis ID:1578736
MD5:62370a84134040d803eae9a4bd34342c
SHA1:207f73ffdcdfa2cb5d713e13385a8c65bb19adf7
SHA256:e84a1edd3826ccb96eadc6d62410361e7820f3c5bc8b7ba308278f33aa2266e4
Tags:exeuser-smica83
Infos:

Detection

Python BackDoor
Score:68
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Multi AV Scanner detection for submitted file
Yara detected Python BackDoor
AI detected suspicious sample
Opens network shares
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Binary contains a suspicious time stamp
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to query CPU information (cpuid)
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Drops PE files
Enables debug privileges
Extensive use of GetProcAddress (often used to hide API calls)
Found dropped PE file which has not been started or loaded
Found evasive API chain (may stop execution after checking a module file name)
Found evasive API chain checking for process token information
Found potential string decryption / allocating functions
IP address seen in connection with other malware
One or more processes crash
PE file contains executable resources (Code or Archives)
PE file contains sections with non-standard names
PE file does not import any functions
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info

Classification

Process Tree

  • System is w10x64
  • wp-s2.exe (PID: 6524 cmdline: "C:\Users\user\Desktop\wp-s2.exe" MD5: 62370A84134040D803EAE9A4BD34342C)
    • wp-s2.exe (PID: 6752 cmdline: "C:\Users\user\Desktop\wp-s2.exe" MD5: 62370A84134040D803EAE9A4BD34342C)
      • systeminfo.exe (PID: 6944 cmdline: systeminfo MD5: EE309A9C61511E907D87B10EF226FDCD)
        • conhost.exe (PID: 6996 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • WmiPrvSE.exe (PID: 4144 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)
      • cmd.exe (PID: 2688 cmdline: C:\Windows\system32\cmd.exe /c "wmic computersystem get manufacturer" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 5936 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • WMIC.exe (PID: 5676 cmdline: wmic computersystem get manufacturer MD5: C37F2F4F4B3CD128BDABCAEB2266A785)
      • WerFault.exe (PID: 6632 cmdline: C:\Windows\system32\WerFault.exe -u -p 6752 -s 940 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000001.00000002.2082080905.000001B81E841000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_PythonBackDoor_1Yara detected Python BackDoorJoe Security
    00000001.00000003.1755036913.000001B81EABA000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_PythonBackDoor_1Yara detected Python BackDoorJoe Security
      00000001.00000003.1755225796.000001B81E7F6000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_PythonBackDoor_1Yara detected Python BackDoorJoe Security
        00000001.00000003.1758008751.000001B81E7F6000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_PythonBackDoor_1Yara detected Python BackDoorJoe Security
          00000001.00000003.1755864798.000001B81EABD000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_PythonBackDoor_1Yara detected Python BackDoorJoe Security
            Click to see the 5 entries

            Sigma Signatures

            ⊘No Sigma rule has matched

            Suricata Signatures

            ⊘No Suricata rule has matched

            Joe Sandbox Signatures

            Click to jump to signature section

            Show All Signature Results

            AV Detection

            barindex
            Multi AV Scanner detection for submitted file
            Source: wp-s2.exeVirustotal: Detection: 8%Perma Link
            AI detected suspicious sample
            Source: Submited SampleIntegrated Neural Analysis Model: Matched 99.5% probability
            Source: wp-s2.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
            Source: Binary string: C:\Users\qt\work\qt\qtsvg\plugins\iconengines\qsvgicon.pdb source: wp-s2.exe, 00000000.00000003.1716671349.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: C:\Users\qt\work\qt\qtsvg\plugins\imageformats\qsvg.pdb source: wp-s2.exe, 00000000.00000003.1717401705.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\generic\qtuiotouchplugin.pdb source: wp-s2.exe, 00000000.00000003.1716509121.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: d:\agent\_work\1\s\\binaries\amd64ret\bin\amd64\\msvcp140.amd64.pdb source: wp-s2.exe, 00000001.00000002.2093179483.00007FFE01435000.00000002.00000001.01000000.0000000D.sdmp
            Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\imageformats\qico.pdb source: wp-s2.exe, 00000000.00000003.1717040182.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG"OpenSSL 3.0.15 3 Sep 20243.0.15built on: Wed Sep 4 15:52:04 2024 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-3"MODULESDIR: "C:\Program Files\OpenSSL\lib\ossl-modules"CPUINFO: N/Anot availableget_and_lock..\s\crypto\ex_data.cossl_crypto_get_ex_new_index_exossl_crypto_new_ex_data_exCRYPTO_dup_ex_dataCRYPTO_set_ex_dataOPENSSL_WIN32_UTF8..\s\crypto\getenv.ccompiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG";CPUINFO: OPENSSL_ia32cap=0x%llx:0x%llxOPENSSL_ia32cap env:%sos-specificC:\Program Files\Common Files\SSLC:\Program Files\OpenSSL\lib\ossl-modules.dllCPUINFO: ..\s\crypto\init.cOPENSSL_init_cryptoOPENSSL_atexit..\s\crypto\initthread.c..\s\crypto\mem_sec.cassertion failed: (bit & 1) == 0assertion failed: list >= 0 && list < sh.freelist_sizeassertion failed: ((ptr - sh.arena) & ((sh.arena_size >> list) - 1)) == 0assertion failed: bit > 0 && bit < sh.bittable_sizeassertion failed: TESTBIT(table, bit)assertion failed: !TESTBIT(table, bit)assertion failed: WITHIN_FREELIST(list)assertion failed: WITHIN_ARENA(ptr)assertion failed: temp->next == NULL || WITHIN_ARENA(temp->next)assertion failed: (char **)temp->next->p_next == listassertion failed: WITHIN_FREELIST(temp2->p_next) || WITHIN_ARENA(temp2->p_next)assertion failed: size > 0assertion failed: (size & (size - 1)) == 0assertion failed: (minsize & (minsize - 1)) == 0assertion failed: sh.freelist != NULLassertion failed: sh.bittable != NULLassertion failed: sh.bitmalloc != NULLassertion failed: !sh_testbit(temp, slist, sh.bitmalloc)assertion failed: temp != sh.freelist[slist]assertion failed: sh.freelist[slist] == tempassertion failed: temp-(sh.arena_size >> slist) == sh_find_my_buddy(temp, slist)assertion failed: sh_testbit(chunk, list, sh.bittable)assertion failed: WITHIN_ARENA(chunk)assertion failed: sh_testbit(ptr, list, sh.bittable)assertion failed: ptr == sh_find_my_buddy(buddy, list)assertion failed: ptr != NULLassertion failed: !sh_testbit(ptr, list, sh.bitmalloc)assertion failed: sh.freelist[list] == ptr/*0123456789ABCDEFCRYPTO_memdup..\s\crypto\o_str.chexstr2buf_sepossl_hexstr2buf_sepbuf2hexstr_sepossl_buf2hexstr_sep..\s\crypto\packet.cwpacket_intern_init_lenWPACKET_start_sub_packet_len__..\s\crypto\param_build.cparam_pushparam_push_numOSSL_PARAM_BLD_push_BN_padNegative big numbers are unsupported for OSSL_PARAMOSSL_PARAM_BLD_push_utf8_stringOSSL_PARAM_BLD_push_utf8_ptrOSSL_PARAM_BLD_push_octet_stringOSSL_PARAM_BLD_p
            Source: Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG" source: wp-s2.exe, 00000001.00000002.2089508974.00007FFDFAAE2000.00000002.00000001.01000000.00000014.sdmp
            Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdbGCTL source: wp-s2.exe, 00000000.00000003.1738003483.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2096082906.00007FFE1A464000.00000002.00000001.01000000.00000005.sdmp
            Source: Binary string: d:\agent\_work\1\s\\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdb source: wp-s2.exe, 00000000.00000003.1701014707.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2095539658.00007FFE12E15000.00000002.00000001.01000000.0000000F.sdmp
            Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdb source: wp-s2.exe, 00000000.00000003.1738782073.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\styles\qwindowsvistastyle.pdb%% source: wp-s2.exe, 00000001.00000002.2093601265.00007FFE0EB57000.00000002.00000001.01000000.00000021.sdmp
            Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\styles\qwindowsvistastyle.pdb source: wp-s2.exe, 00000001.00000002.2093601265.00007FFE0EB57000.00000002.00000001.01000000.00000021.sdmp
            Source: Binary string: D:\a\1\b\bin\amd64\_ctypes.pdb source: wp-s2.exe, 00000001.00000002.2095760829.00007FFE13213000.00000002.00000001.01000000.00000007.sdmp
            Source: Binary string: D:\a\1\b\bin\amd64\_hashlib.pdb source: wp-s2.exe, 00000000.00000003.1739775823.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2095195470.00007FFE120C6000.00000002.00000001.01000000.00000016.sdmp
            Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\imageformats\qico.pdb source: wp-s2.exe, 00000000.00000003.1717040182.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\generic\qtuiotouchplugin.pdb source: wp-s2.exe, 00000000.00000003.1716509121.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: C:\Users\qt\work\qt\qtbase\lib\Qt5Core.pdbT source: wp-s2.exe, 00000001.00000002.2090128814.00007FFDFB0B6000.00000002.00000001.01000000.0000000C.sdmp
            Source: Binary string: C:\Users\qt\work\qt\qtbase\lib\Qt5Gui.pdb source: wp-s2.exe, 00000001.00000002.2087013621.00007FFDF9A2A000.00000002.00000001.01000000.0000001E.sdmp
            Source: Binary string: D:\a\1\b\bin\amd64\_lzma.pdb source: wp-s2.exe, 00000000.00000003.1739924950.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2095410985.00007FFE126EB000.00000002.00000001.01000000.0000000A.sdmp
            Source: Binary string: D:\a\1\b\bin\amd64\_bz2.pdb source: wp-s2.exe, 00000000.00000003.1738961170.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2095869665.00007FFE1330D000.00000002.00000001.01000000.00000009.sdmp
            Source: Binary string: D:\a\1\b\bin\amd64\_socket.pdb source: wp-s2.exe, 00000000.00000003.1740181136.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2094967647.00007FFE11EA9000.00000002.00000001.01000000.00000011.sdmp
            Source: Binary string: D:\a\1\b\bin\amd64\python313.pdb source: wp-s2.exe, 00000001.00000002.2091458277.00007FFDFB888000.00000002.00000001.01000000.00000004.sdmp
            Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdbGCTL source: wp-s2.exe, 00000000.00000003.1738782073.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: d:\agent\_work\1\s\\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: wp-s2.exe, 00000000.00000003.1700785114.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: C:\Users\qt\work\qt\qtimageformats\plugins\imageformats\qtiff.pdbBB source: wp-s2.exe, 00000000.00000003.1717803010.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\platformthemes\qxdgdesktopportal.pdb source: wp-s2.exe, 00000000.00000003.1719838444.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: D:\a\1\b\bin\amd64\unicodedata.pdb source: wp-s2.exe, 00000000.00000003.1747633937.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2092647545.00007FFE00827000.00000002.00000001.01000000.0000001A.sdmp
            Source: Binary string: d:\agent\_work\1\s\\binaries\amd64ret\bin\amd64\\msvcp140_1.amd64.pdb source: wp-s2.exe, 00000000.00000003.1691042886.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2095651317.00007FFE130C3000.00000002.00000001.01000000.0000000E.sdmp
            Source: Binary string: D:\a\1\b\libcrypto-3.pdb| source: wp-s2.exe, 00000001.00000002.2089508974.00007FFDFAB7A000.00000002.00000001.01000000.00000014.sdmp
            Source: Binary string: D:\a\1\b\libssl-3.pdbDD source: wp-s2.exe, 00000001.00000002.2092970035.00007FFE01395000.00000002.00000001.01000000.00000015.sdmp
            Source: Binary string: C:\Users\qt\work\qt\qtbase\lib\Qt5Core.pdb source: wp-s2.exe, 00000001.00000002.2090128814.00007FFDFB0B6000.00000002.00000001.01000000.0000000C.sdmp
            Source: Binary string: C:\Users\qt\work\qt\qtimageformats\plugins\imageformats\qtiff.pdb source: wp-s2.exe, 00000000.00000003.1717803010.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\imageformats\qgif.pdb source: wp-s2.exe, 00000000.00000003.1716792661.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: D:\a\1\b\bin\amd64\_wmi.pdb(('GCTL source: wp-s2.exe, 00000000.00000003.1741028108.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: C:\Users\qt\work\qt\qtimageformats\plugins\imageformats\qtga.pdb source: wp-s2.exe, 00000000.00000003.1717538177.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: wp-s2.exe, 00000000.00000003.1738003483.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2096082906.00007FFE1A464000.00000002.00000001.01000000.00000005.sdmp
            Source: Binary string: D:\a\1\b\libcrypto-3.pdb source: wp-s2.exe, 00000001.00000002.2089508974.00007FFDFAB7A000.00000002.00000001.01000000.00000014.sdmp
            Source: Binary string: C:\Users\qt\work\qt\qtimageformats\plugins\imageformats\qicns.pdb source: wp-s2.exe, 00000000.00000003.1716926948.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: D:\a\1\b\bin\amd64\select.pdb source: wp-s2.exe, 00000000.00000003.1747354150.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2095303412.00007FFE126C3000.00000002.00000001.01000000.00000012.sdmp
            Source: Binary string: D:\a\1\b\bin\amd64\_lzma.pdbNN source: wp-s2.exe, 00000000.00000003.1739924950.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2095410985.00007FFE126EB000.00000002.00000001.01000000.0000000A.sdmp
            Source: Binary string: D:\a\1\b\bin\amd64\_queue.pdb source: wp-s2.exe, 00000000.00000003.1740078161.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2094786013.00007FFE11BB3000.00000002.00000001.01000000.00000017.sdmp
            Source: Binary string: D:\a\1\b\bin\amd64\_wmi.pdb source: wp-s2.exe, 00000000.00000003.1741028108.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: C:\Users\qt\work\qt\qtbase\lib\Qt5Widgets.pdb source: wp-s2.exe, 00000001.00000002.2087602644.00007FFDFA02A000.00000002.00000001.01000000.0000001D.sdmp
            Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\platforms\qwindows.pdb source: wp-s2.exe, 00000001.00000002.2085851674.00007FFDF9344000.00000002.00000001.01000000.00000020.sdmp
            Source: Binary string: D:\a\1\b\bin\amd64\python3.pdb source: wp-s2.exe, 00000000.00000003.1744869654.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2081582775.000001B81E0B0000.00000002.00000001.01000000.00000006.sdmp
            Source: Binary string: C:\Users\qt\work\qt\qtimageformats\plugins\imageformats\qwbmp.pdb source: wp-s2.exe, 00000000.00000003.1718025414.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: C:\Users\qt\work\qt\qtbase\lib\libEGL.pdb source: wp-s2.exe, 00000000.00000003.1704282045.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: D:\a\1\b\libssl-3.pdb source: wp-s2.exe, 00000001.00000002.2092970035.00007FFE01395000.00000002.00000001.01000000.00000015.sdmp
            Source: Binary string: D:\a\1\b\bin\amd64\_ssl.pdb source: wp-s2.exe, 00000001.00000002.2094441421.00007FFE1150E000.00000002.00000001.01000000.00000013.sdmp
            Source: C:\Users\user\Desktop\wp-s2.exeCode function: 0_2_00007FF6D09E9280 FindFirstFileExW,FindClose,0_2_00007FF6D09E9280
            Source: C:\Users\user\Desktop\wp-s2.exeCode function: 0_2_00007FF6D09E83C0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,0_2_00007FF6D09E83C0
            Source: C:\Users\user\Desktop\wp-s2.exeCode function: 0_2_00007FF6D0A01874 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,0_2_00007FF6D0A01874
            Source: C:\Users\user\Desktop\wp-s2.exeCode function: 1_2_00007FF6D09E9280 FindFirstFileExW,FindClose,1_2_00007FF6D09E9280
            Source: C:\Windows\System32\WerFault.exeFile opened: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\bin\Jump to behavior
            Source: C:\Windows\System32\WerFault.exeFile opened: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\Jump to behavior
            Source: C:\Windows\System32\WerFault.exeFile opened: C:\Users\user\AppData\Local\Jump to behavior
            Source: C:\Windows\System32\WerFault.exeFile opened: C:\Users\user\AppData\Jump to behavior
            Source: C:\Windows\System32\WerFault.exeFile opened: C:\Users\user\Jump to behavior
            Source: C:\Windows\System32\WerFault.exeFile opened: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Jump to behavior
            Source: Joe Sandbox ViewIP Address: 104.20.22.46 104.20.22.46
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: global trafficDNS traffic detected: DNS query: nodejs.org
            Source: wp-s2.exe, 00000001.00000002.2083678251.000001B81F1C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://.../back.jpeg
            Source: wp-s2.exe, 00000000.00000003.1747633937.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1740872836.000001D2961A5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digi
            Source: wp-s2.exe, 00000000.00000003.1704282045.000001D2961A4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredID
            Source: wp-s2.exe, 00000000.00000003.1717401705.000001D2961B1000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1695666686.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1716926948.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1697798406.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1697273457.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1719480565.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1698741421.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1718025414.000001D2961B1000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1716792661.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1718862315.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1717538177.000001D2961B1000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1717803010.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1704773732.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1691739148.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1694229514.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1698906239.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1718524179.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1704282045.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1692963511.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1717172660.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1718025414.000001D2961A4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
            Source: wp-s2.exe, 00000000.00000003.1744869654.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1747633937.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1738961170.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1739924950.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1740078161.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1740872836.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1740181136.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1744214545.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1745691225.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1739421344.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1747354150.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1739600157.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1741028108.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1743974562.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1742512200.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1742512200.000001D2961B2000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1739775823.000001D2961A5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
            Source: wp-s2.exe, 00000000.00000003.1695666686.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1716926948.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1697798406.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1697273457.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1719480565.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1698741421.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1716792661.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1718862315.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1717803010.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1704773732.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1691739148.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1694229514.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1698906239.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1718524179.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1704282045.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1692963511.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1717172660.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1718025414.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1717538177.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1699513790.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1719838444.000001D2961A5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
            Source: wp-s2.exe, 00000000.00000003.1717401705.000001D2961B1000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1695666686.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1716926948.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1697798406.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1697273457.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1719480565.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1698741421.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1718025414.000001D2961B1000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1716792661.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1718862315.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1717538177.000001D2961B1000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1717803010.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1704773732.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1691739148.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1694229514.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1698906239.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1718524179.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1704282045.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1692963511.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1717172660.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1718025414.000001D2961A4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
            Source: wp-s2.exe, 00000000.00000003.1744869654.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1747633937.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1738961170.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1739924950.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1740078161.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1740872836.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1740181136.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1744214545.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1742512200.000001D2961AC000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1745691225.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1739421344.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1747354150.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1739600157.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1741028108.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1743974562.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1742512200.000001D2961B2000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1739775823.000001D2961A5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
            Source: wp-s2.exe, 00000000.00000003.1744869654.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1747633937.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1738961170.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1739924950.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1740078161.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1740872836.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1740181136.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1744214545.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1745691225.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1739421344.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1747354150.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1739600157.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1741028108.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1743974562.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1742512200.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1739775823.000001D2961A5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
            Source: wp-s2.exe, 00000000.00000003.1744869654.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1747633937.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1738961170.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1739924950.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1740078161.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1740872836.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1740181136.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1744214545.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1742512200.000001D2961AC000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1745691225.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1739421344.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1747354150.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1739600157.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1741028108.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1743974562.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1742512200.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1739775823.000001D2961A5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
            Source: wp-s2.exe, 00000001.00000003.1760589925.000001B81EC7C000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1765860509.000001B81EC52000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1781570040.000001B81EC52000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1762017406.000001B81EC52000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1760937335.000001B81EC52000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2082516614.000001B81EC52000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://code.activestate.com/recipes/577452-a-memoize-decorator-for-instance-methods/
            Source: wp-s2.exe, 00000001.00000003.1781570040.000001B81EE1D000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2082516614.000001B81EE1B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.certigna.fr/certignarootca.crl01
            Source: wp-s2.exe, 00000001.00000002.2081888920.000001B81E310000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1781570040.000001B81EC52000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2082516614.000001B81EC52000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
            Source: wp-s2.exe, 00000001.00000002.2082080905.000001B81E782000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.comodoca.com/COMODOCertificationAuthority.crl
            Source: wp-s2.exe, 00000001.00000003.1781570040.000001B81EC52000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2082516614.000001B81EC52000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.comodoca.com/COMODOCertificationAuthority.crlr
            Source: wp-s2.exe, 00000001.00000003.1781570040.000001B81EE1D000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2082516614.000001B81EE1B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.dhimyotis.com/certignarootca.crl
            Source: wp-s2.exe, 00000001.00000002.2082516614.000001B81EDBA000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1786232962.000001B81EDBA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.securetrust.com/SGCA.crl
            Source: wp-s2.exe, 00000001.00000002.2082516614.000001B81EBA5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1781570040.000001B81EBA5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.securetrust.com/SGCA.crl0
            Source: wp-s2.exe, 00000001.00000002.2082516614.000001B81EDBA000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1786232962.000001B81EDBA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.securetrust.com/STCA.crl
            Source: wp-s2.exe, 00000001.00000002.2082516614.000001B81EBA5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1781570040.000001B81EBA5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.securetrust.com/STCA.crl0
            Source: wp-s2.exe, 00000001.00000002.2082516614.000001B81EDBA000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1786232962.000001B81EDBA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl
            Source: wp-s2.exe, 00000001.00000003.1781570040.000001B81EC52000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2082516614.000001B81EC52000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl0
            Source: wp-s2.exe, 00000000.00000003.1744869654.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1747633937.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1738961170.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1739924950.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1740078161.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1740872836.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1740181136.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1744214545.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1745691225.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1739421344.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1747354150.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1739600157.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1741028108.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1743974562.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1742512200.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1742512200.000001D2961B2000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1739775823.000001D2961A5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
            Source: wp-s2.exe, 00000000.00000003.1695666686.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1716926948.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1697798406.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1697273457.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1719480565.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1698741421.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1716792661.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1718862315.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1717803010.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1704773732.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1691739148.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1694229514.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1698906239.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1718524179.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1704282045.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1692963511.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1717172660.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1718025414.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1717538177.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1699513790.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1719838444.000001D2961A5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
            Source: wp-s2.exe, 00000000.00000003.1717401705.000001D2961B1000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1695666686.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1716926948.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1697798406.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1697273457.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1719480565.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1698741421.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1718025414.000001D2961B1000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1716792661.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1718862315.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1717538177.000001D2961B1000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1717803010.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1704773732.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1691739148.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1694229514.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1698906239.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1718524179.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1704282045.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1692963511.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1717172660.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1718025414.000001D2961A4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
            Source: wp-s2.exe, 00000000.00000003.1744869654.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1747633937.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1738961170.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1739924950.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1740078161.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1740872836.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1740181136.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1744214545.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1742512200.000001D2961AC000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1745691225.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1739421344.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1747354150.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1739600157.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1741028108.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1743974562.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1742512200.000001D2961B2000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1739775823.000001D2961A5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
            Source: wp-s2.exe, 00000000.00000003.1744869654.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1747633937.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1738961170.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1739924950.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1740078161.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1740872836.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1740181136.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1744214545.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1745691225.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1739421344.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1747354150.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1739600157.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1741028108.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1743974562.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1742512200.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1739775823.000001D2961A5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
            Source: wp-s2.exe, 00000000.00000003.1739775823.000001D2961A5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
            Source: wp-s2.exe, 00000000.00000003.1695666686.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1716926948.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1697798406.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1697273457.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1719480565.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1698741421.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1716792661.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1718862315.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1717803010.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1704773732.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1691739148.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1694229514.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1698906239.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1718524179.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1704282045.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1692963511.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1717172660.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1718025414.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1717538177.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1699513790.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1719838444.000001D2961A5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
            Source: wp-s2.exe, 00000000.00000003.1718192942.000001D2961A4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl
            Source: wp-s2.exe, 00000000.00000003.1717401705.000001D2961B1000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1695666686.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1716926948.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1697798406.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1697273457.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1719480565.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1698741421.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1718025414.000001D2961B1000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1716792661.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1718862315.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1717538177.000001D2961B1000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1717803010.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1704773732.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1691739148.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1694229514.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1698906239.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1718524179.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1704282045.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1692963511.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1717172660.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1718025414.000001D2961A4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
            Source: wp-s2.exe, 00000000.00000003.1717401705.000001D2961B1000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1695666686.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1716926948.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1697798406.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1697273457.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1719480565.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1698741421.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1718025414.000001D2961B1000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1716792661.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1718862315.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1717538177.000001D2961B1000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1717803010.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1704773732.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1691739148.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1694229514.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1698906239.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1718524179.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1704282045.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1692963511.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1717172660.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1718025414.000001D2961A4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
            Source: wp-s2.exe, 00000000.00000003.1744869654.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1747633937.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1738961170.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1739924950.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1740078161.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1740872836.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1740181136.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1744214545.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1742512200.000001D2961AC000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1745691225.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1739421344.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1747354150.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1739600157.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1741028108.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1743974562.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1742512200.000001D2961B2000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1739775823.000001D2961A5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
            Source: wp-s2.exe, 00000000.00000003.1695666686.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1716926948.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1697798406.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1697273457.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1719480565.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1698741421.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1716792661.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1718862315.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1717803010.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1704773732.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1691739148.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1694229514.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1698906239.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1718524179.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1704282045.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1692963511.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1717172660.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1718025414.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1717538177.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1699513790.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1719838444.000001D2961A5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0L
            Source: wp-s2.exe, 00000000.00000003.1717401705.000001D2961B1000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1695666686.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1716926948.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1697798406.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1697273457.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1719480565.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1698741421.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1718025414.000001D2961B1000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1716792661.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1718862315.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1717538177.000001D2961B1000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1717803010.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1704773732.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1691739148.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1694229514.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1698906239.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1718524179.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1704282045.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1692963511.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1717172660.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1718025414.000001D2961A4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
            Source: wp-s2.exe, 00000001.00000003.1759279653.000001B81ECE8000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2083678251.000001B81F1C0000.00000004.00001000.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1759279653.000001B81ED43000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://curl.haxx.se/rfc/cookie_spec.html
            Source: wp-s2.exe, 00000001.00000002.2083815498.000001B81F3B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://goo.gl/zeJZl.
            Source: wp-s2.exe, 00000001.00000002.2082080905.000001B81E782000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://google.com/
            Source: wp-s2.exe, 00000001.00000002.2081888920.000001B81E310000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1760549875.000001B81E3D2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://google.com/mail/
            Source: wp-s2.exe, 00000001.00000002.2082516614.000001B81EBFC000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1781570040.000001B81EBFC000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1760937335.000001B81EC02000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1759396614.000001B81EC02000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2082516614.000001B81EAA1000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1765860509.000001B81EBFC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://hg.python.org/cpython/file/603b4d593758/Lib/socket.py#l535
            Source: wp-s2.exe, 00000001.00000002.2083678251.000001B81F1C0000.00000004.00001000.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2082516614.000001B81EC52000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://mail.python.org/pipermail/python-dev/2012-June/120787.html.
            Source: wp-s2.exe, 00000001.00000002.2082516614.000001B81EDBA000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1786232962.000001B81EDBA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.accv.es
            Source: wp-s2.exe, 00000001.00000003.1781570040.000001B81EE1D000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2082516614.000001B81EE1B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.accv.es0
            Source: wp-s2.exe, 00000000.00000003.1744869654.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1747633937.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1738961170.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1739924950.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1740078161.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1740872836.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1740181136.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1744214545.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1742512200.000001D2961AC000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1745691225.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1739421344.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1747354150.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1739600157.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1741028108.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1743974562.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1742512200.000001D2961B2000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1739775823.000001D2961A5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0
            Source: wp-s2.exe, 00000000.00000003.1744869654.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1747633937.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1738961170.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1739924950.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1740078161.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1740872836.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1740181136.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1744214545.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1742512200.000001D2961AC000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1745691225.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1739421344.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1747354150.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1739600157.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1741028108.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1743974562.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1742512200.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1739775823.000001D2961A5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0A
            Source: wp-s2.exe, 00000000.00000003.1744869654.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1717401705.000001D2961B1000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1695666686.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1747633937.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1738961170.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1716926948.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1697798406.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1739924950.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1697273457.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1719480565.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1740078161.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1740872836.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1698741421.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1718025414.000001D2961B1000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1716792661.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1740181136.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1718862315.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1717538177.000001D2961B1000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1717803010.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1704773732.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1691739148.000001D2961A4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0C
            Source: wp-s2.exe, 00000000.00000003.1695666686.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1716926948.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1697798406.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1697273457.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1719480565.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1698741421.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1716792661.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1718862315.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1717803010.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1704773732.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1691739148.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1694229514.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1698906239.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1718524179.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1704282045.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1692963511.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1717172660.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1718025414.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1717538177.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1699513790.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1719838444.000001D2961A5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0N
            Source: wp-s2.exe, 00000000.00000003.1717401705.000001D2961B1000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1695666686.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1716926948.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1697798406.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1697273457.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1719480565.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1698741421.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1718025414.000001D2961B1000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1716792661.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1718862315.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1717538177.000001D2961B1000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1717803010.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1704773732.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1691739148.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1694229514.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1698906239.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1718524179.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1704282045.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1692963511.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1717172660.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1718025414.000001D2961A4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0O
            Source: wp-s2.exe, 00000000.00000003.1744869654.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1747633937.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1738961170.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1739924950.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1740078161.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1740872836.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1740181136.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1744214545.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1745691225.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1739421344.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1747354150.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1739600157.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1741028108.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1743974562.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1742512200.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1739775823.000001D2961A5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0X
            Source: wp-s2.exe, 00000001.00000002.2082080905.000001B81E782000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2082516614.000001B81EC52000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://repository.swisssign.com/
            Source: wp-s2.exe, 00000001.00000003.1781570040.000001B81EC52000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2082516614.000001B81EC52000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://repository.swisssign.com/Y
            Source: wp-s2.exe, 00000001.00000002.2083573190.000001B81F090000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://tools.ietf.org/html/rfc6125#section-6.4.3
            Source: wp-s2.exe, 00000001.00000002.2082516614.000001B81EDBA000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1781570040.000001B81EE1D000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1786232962.000001B81EDBA000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2082516614.000001B81EE1B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1.crt0
            Source: wp-s2.exe, 00000001.00000002.2082516614.000001B81EDBA000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1786232962.000001B81EDBA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl
            Source: wp-s2.exe, 00000001.00000003.1781570040.000001B81EE1D000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2082516614.000001B81EE1B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl0
            Source: wp-s2.exe, 00000001.00000002.2082516614.000001B81EDBA000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1786232962.000001B81EDBA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crlsj
            Source: wp-s2.exe, 00000001.00000002.2082516614.000001B81EDBA000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1786232962.000001B81EDBA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.accv.es/legislacion_c.htm
            Source: wp-s2.exe, 00000001.00000003.1781570040.000001B81EE1D000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2082516614.000001B81EE1B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.accv.es/legislacion_c.htm0U
            Source: wp-s2.exe, 00000001.00000002.2082516614.000001B81EDBA000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1781570040.000001B81EE1D000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1786232962.000001B81EDBA000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2082516614.000001B81EE1B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.accv.es00
            Source: wp-s2.exe, 00000001.00000002.2087013621.00007FFDF9A2A000.00000002.00000001.01000000.0000001E.sdmpString found in binary or memory: http://www.aiim.org/pdfa/ns/id/
            Source: wp-s2.exe, 00000001.00000003.1781570040.000001B81EE1D000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2081888920.000001B81E310000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2082516614.000001B81EE1B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.cert.fnmt.es/dpcs/
            Source: wp-s2.exe, 00000001.00000002.2081888920.000001B81E310000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.cert.fnmt.es/dpcs/0
            Source: wp-s2.exe, 00000001.00000003.1781570040.000001B81EE1D000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2082516614.000001B81EE1B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.cert.fnmt.es/dpcs/K$
            Source: wp-s2.exe, 00000001.00000002.2087013621.00007FFDF9A2A000.00000002.00000001.01000000.0000001E.sdmpString found in binary or memory: http://www.color.org)
            Source: wp-s2.exe, 00000000.00000003.1744869654.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1747633937.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1738961170.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1739924950.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1740078161.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1740872836.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1740181136.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1744214545.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1742512200.000001D2961AC000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1745691225.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1739421344.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1747354150.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1739600157.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1741028108.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1743974562.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1742512200.000001D2961B2000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1739775823.000001D2961A5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.digicert.com/CPS0
            Source: wp-s2.exe, 00000001.00000003.1781570040.000001B81EE1D000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1781570040.000001B81EC52000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2082516614.000001B81EC52000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2082516614.000001B81EE1B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.firmaprofesional.com/cps0
            Source: wp-s2.exe, 00000001.00000002.2082080905.000001B81E650000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6
            Source: wp-s2.exe, 00000001.00000002.2082516614.000001B81EDBA000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1786232962.000001B81EDBA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.quovadisglobal.com/cps
            Source: wp-s2.exe, 00000001.00000002.2082516614.000001B81EDBA000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1786232962.000001B81EDBA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.quovadisglobal.com/cps0
            Source: wp-s2.exe, 00000001.00000002.2082516614.000001B81EDBA000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1786232962.000001B81EDBA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.quovadisglobal.com/cpsJ
            Source: wp-s2.exe, 00000001.00000003.1760937335.000001B81ECC7000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1759279653.000001B81ECE8000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1783712261.000001B81ECB6000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1759396614.000001B81ECC7000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2082516614.000001B81ECB6000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1765860509.000001B81ECB6000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1759279653.000001B81ED43000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://wwwsearch.sf.net/):
            Source: wp-s2.exe, 00000001.00000002.2081888920.000001B81E310000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1760549875.000001B81E3D2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3.11/library/binascii.html#binascii.a2b_base64
            Source: wp-s2.exe, 00000001.00000002.2081983260.000001B81E550000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/howto/mro.html.
            Source: wp-s2.exe, 00000001.00000002.2081660537.000001B81E110000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.ExecutionLoader.get_filename
            Source: wp-s2.exe, 00000001.00000002.2081660537.000001B81E110000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.get_code
            Source: wp-s2.exe, 00000001.00000002.2081660537.000001B81E194000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.get_source
            Source: wp-s2.exe, 00000001.00000002.2081660537.000001B81E110000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.is_package
            Source: wp-s2.exe, 00000001.00000002.2081660537.000001B81E194000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.Loader.create_module
            Source: wp-s2.exe, 00000001.00000002.2081660537.000001B81E110000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.Loader.exec_module
            Source: wp-s2.exe, 00000001.00000002.2081660537.000001B81E110000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.MetaPathFinder.invalidate_caches
            Source: wp-s2.exe, 00000001.00000002.2081660537.000001B81E110000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.PathEntryFinder.find_spec
            Source: wp-s2.exe, 00000001.00000002.2081888920.000001B81E310000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.ResourceLoader.get_data
            Source: wp-s2.exe, 00000001.00000002.2083312157.000001B81EE70000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://foss.heptapod.net/pypy/pypy/-/issues/3539
            Source: wp-s2.exe, 00000001.00000003.1760589925.000001B81EC7C000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1765860509.000001B81EC52000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1781570040.000001B81EC52000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1762017406.000001B81EC52000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1760937335.000001B81EC52000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2082516614.000001B81EC52000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/Ousret/charset_normalizer
            Source: wp-s2.exe, 00000001.00000002.2081888920.000001B81E310000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy
            Source: wp-s2.exe, 00000001.00000002.2084943619.000001B81FBF4000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/giampaolo/psutil/issues/875.
            Source: wp-s2.exe, 00000001.00000002.2083815498.000001B81F344000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/psf/requests/pull/6710
            Source: wp-s2.exe, 00000001.00000002.2081660537.000001B81E194000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688
            Source: wp-s2.exe, 00000001.00000002.2081888920.000001B81E310000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py
            Source: wp-s2.exe, 00000001.00000002.2081888920.000001B81E310000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader
            Source: wp-s2.exe, 00000001.00000003.1754622319.000001B81E803000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1754674201.000001B81E7FC000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1756150289.000001B81E7BC000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1758008751.000001B81E78C000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2082080905.000001B81E782000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1757204060.000001B81E78C000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1755225796.000001B81E7BC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python/cpython/issues/86361.
            Source: wp-s2.exe, 00000001.00000002.2082426797.000001B81E950000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/python/importlib_metadata/wiki/Development-Methodology
            Source: wp-s2.exe, 00000001.00000002.2081888920.000001B81E310000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#
            Source: wp-s2.exe, 00000001.00000002.2082516614.000001B81EBFC000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1781570040.000001B81EBFC000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1760937335.000001B81EC02000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2083312157.000001B81EE70000.00000004.00001000.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1759396614.000001B81EC02000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1765860509.000001B81EBFC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/urllib3/urllib3/issues/2192#issuecomment-821832963
            Source: wp-s2.exe, 00000001.00000003.1760589925.000001B81EC7C000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1761764389.000001B81ECA7000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1781570040.000001B81EB46000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2082516614.000001B81EB46000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1760937335.000001B81EB46000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1760937335.000001B81EC52000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/urllib3/urllib3/issues/2513#issuecomment-1152559900.
            Source: wp-s2.exe, 00000001.00000002.2083573190.000001B81F090000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/urllib3/urllib3/issues/2920
            Source: wp-s2.exe, 00000001.00000002.2083573190.000001B81F090000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/urllib3/urllib3/issues/3290
            Source: wp-s2.exe, 00000001.00000002.2082516614.000001B81EC52000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://google.com/
            Source: wp-s2.exe, 00000001.00000003.1760589925.000001B81EC7C000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1765860509.000001B81EC52000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2082080905.000001B81E650000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1781570040.000001B81EC52000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1762017406.000001B81EC52000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1760937335.000001B81EC52000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2082516614.000001B81EC52000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://google.com/mail
            Source: wp-s2.exe, 00000001.00000003.1760937335.000001B81EC52000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://google.com/mail/
            Source: wp-s2.exe, 00000001.00000003.1760589925.000001B81EC7C000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1765860509.000001B81EC52000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1781570040.000001B81EC52000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1762017406.000001B81EC52000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1760937335.000001B81EC52000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2082516614.000001B81EC52000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://html.spec.whatwg.org/multipage/
            Source: wp-s2.exe, 00000001.00000002.2082516614.000001B81EC52000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://httpbin.org/
            Source: wp-s2.exe, 00000001.00000002.2083678251.000001B81F1C0000.00000004.00001000.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2082516614.000001B81EC52000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://httpbin.org/get
            Source: wp-s2.exe, 00000001.00000003.1756636619.000001B81E6CE000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1757583955.000001B81E754000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1756150289.000001B81E754000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1758008751.000001B81E754000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2082080905.000001B81E73E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://httpbin.org/post
            Source: wp-s2.exe, 00000001.00000002.2082516614.000001B81EAA1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://json.org
            Source: wp-s2.exe, 00000001.00000003.1762895106.000001B81ED79000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1783712261.000001B81ED6D000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1760839874.000001B81ED58000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1760907838.000001B81ED5D000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2082516614.000001B81ED68000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://mahler:8092/site-updates.py
            Source: wp-s2.exe, 00000001.00000002.2082426797.000001B81E950000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://nodejs.org/dist/v22.11.0/node-v22.11.0-win-x64.zip
            Source: wp-s2.exe, 00000001.00000002.2083573190.000001B81F090000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://packaging.python.org/en/latest/specifications/core-metadata/#core-metadata
            Source: wp-s2.exe, 00000001.00000002.2082080905.000001B81E782000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://packaging.python.org/en/latest/specifications/entry-points/#file-format
            Source: wp-s2.exe, 00000001.00000002.2082080905.000001B81E782000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://packaging.python.org/en/latest/specifications/recording-installed-packages/#the-record-file
            Source: wp-s2.exe, 00000001.00000002.2083478692.000001B81EF90000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://packaging.python.org/specifications/entry-points/
            Source: wp-s2.exe, 00000001.00000002.2082321401.000001B81E850000.00000004.00001000.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1756150289.000001B81E7BC000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1750070545.000001B81E311000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1757204060.000001B81E78C000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1755225796.000001B81E7BC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://peps.python.org/pep-0205/
            Source: wp-s2.exe, 00000001.00000002.2091458277.00007FFDFB888000.00000002.00000001.01000000.00000004.sdmpString found in binary or memory: https://peps.python.org/pep-0263/
            Source: wp-s2.exe, 00000001.00000002.2083815498.000001B81F344000.00000004.00001000.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1756636619.000001B81E6CE000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1757583955.000001B81E754000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1756150289.000001B81E754000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1758008751.000001B81E754000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2082080905.000001B81E73E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://requests.readthedocs.io
            Source: wp-s2.exe, 00000001.00000002.2084943619.000001B81FBF4000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://stackoverflow.com/questions/4457745#4457745.
            Source: wp-s2.exe, 00000001.00000003.1762017406.000001B81EBA5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1759396614.000001B81EBA5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2082516614.000001B81EBA5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1781570040.000001B81EBA5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tools.ietf.org/html/rfc2388#section-4.4
            Source: wp-s2.exe, 00000001.00000002.2082080905.000001B81E650000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1757135082.000001B81EB76000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1757135082.000001B81EB97000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tools.ietf.org/html/rfc7231#section-4.3.6)
            Source: wp-s2.exe, 00000001.00000003.1760589925.000001B81EC7C000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1765860509.000001B81EC52000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1781570040.000001B81EC52000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1762017406.000001B81EC52000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1760937335.000001B81EC52000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2082516614.000001B81EC52000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://twitter.com/
            Source: wp-s2.exe, 00000001.00000002.2083478692.000001B81EF90000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#https-proxy-error-http-proxy
            Source: wp-s2.exe, 00000001.00000002.2083478692.000001B81EF90000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings
            Source: wp-s2.exe, 00000000.00000003.1717401705.000001D2961B1000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1695666686.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1716926948.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1697798406.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1697273457.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1719480565.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1698741421.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1718025414.000001D2961B1000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1716792661.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1718862315.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1717538177.000001D2961B1000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1717803010.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1704773732.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1691739148.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1694229514.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1698906239.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1718524179.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1704282045.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1692963511.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1717172660.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1718025414.000001D2961A4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.digicert.com/CPS0
            Source: wp-s2.exe, 00000000.00000003.1744214545.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2089805565.00007FFDFAC24000.00000002.00000001.01000000.00000014.sdmp, wp-s2.exe, 00000001.00000002.2093031370.00007FFE013D0000.00000002.00000001.01000000.00000015.sdmpString found in binary or memory: https://www.openssl.org/H
            Source: wp-s2.exe, 00000001.00000003.1756636619.000001B81E6CE000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1757583955.000001B81E754000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1756150289.000001B81E754000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1758008751.000001B81E754000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2082080905.000001B81E73E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.python.org
            Source: wp-s2.exe, 00000001.00000003.1762895106.000001B81ED79000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1783712261.000001B81ED6D000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1760839874.000001B81ED58000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1760907838.000001B81ED5D000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2082516614.000001B81ED68000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.python.org/
            Source: wp-s2.exe, 00000001.00000002.2091458277.00007FFDFB888000.00000002.00000001.01000000.00000004.sdmpString found in binary or memory: https://www.python.org/psf/license/)
            Source: wp-s2.exe, 00000001.00000003.1760589925.000001B81EC7C000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1765860509.000001B81EC52000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2082080905.000001B81E650000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1781570040.000001B81EC52000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1762017406.000001B81EC52000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1760937335.000001B81EC52000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2082516614.000001B81EC52000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.rfc-editor.org/rfc/rfc8259#section-8.1
            Source: wp-s2.exe, 00000001.00000003.1781570040.000001B81EE1D000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2082516614.000001B81EE1B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://wwww.certigna.fr/autorites/
            Source: wp-s2.exe, 00000001.00000003.1781570040.000001B81EE1D000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2082516614.000001B81EE1B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://wwww.certigna.fr/autorites/0m
            Source: wp-s2.exe, 00000001.00000003.1760589925.000001B81EC7C000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1765860509.000001B81EC52000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2082080905.000001B81E650000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1781570040.000001B81EC52000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1762017406.000001B81EC52000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1760937335.000001B81EC52000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2082516614.000001B81EC52000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://yahoo.com/
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49731
            Source: unknownNetwork traffic detected: HTTP traffic on port 49731 -> 443
            Source: C:\Users\user\Desktop\wp-s2.exeCode function: 0_2_00007FF6D09E89E00_2_00007FF6D09E89E0
            Source: C:\Users\user\Desktop\wp-s2.exeCode function: 0_2_00007FF6D0A069640_2_00007FF6D0A06964
            Source: C:\Users\user\Desktop\wp-s2.exeCode function: 0_2_00007FF6D0A05C000_2_00007FF6D0A05C00
            Source: C:\Users\user\Desktop\wp-s2.exeCode function: 0_2_00007FF6D09E10000_2_00007FF6D09E1000
            Source: C:\Users\user\Desktop\wp-s2.exeCode function: 0_2_00007FF6D0A008C80_2_00007FF6D0A008C8
            Source: C:\Users\user\Desktop\wp-s2.exeCode function: 0_2_00007FF6D09F21640_2_00007FF6D09F2164
            Source: C:\Users\user\Desktop\wp-s2.exeCode function: 0_2_00007FF6D09F19440_2_00007FF6D09F1944
            Source: C:\Users\user\Desktop\wp-s2.exeCode function: 0_2_00007FF6D09F39A40_2_00007FF6D09F39A4
            Source: C:\Users\user\Desktop\wp-s2.exeCode function: 0_2_00007FF6D09EA2DB0_2_00007FF6D09EA2DB
            Source: C:\Users\user\Desktop\wp-s2.exeCode function: 0_2_00007FF6D09FDA5C0_2_00007FF6D09FDA5C
            Source: C:\Users\user\Desktop\wp-s2.exeCode function: 0_2_00007FF6D0A008C80_2_00007FF6D0A008C8
            Source: C:\Users\user\Desktop\wp-s2.exeCode function: 0_2_00007FF6D0A064180_2_00007FF6D0A06418
            Source: C:\Users\user\Desktop\wp-s2.exeCode function: 0_2_00007FF6D09F2C100_2_00007FF6D09F2C10
            Source: C:\Users\user\Desktop\wp-s2.exeCode function: 0_2_00007FF6D0A03C100_2_00007FF6D0A03C10
            Source: C:\Users\user\Desktop\wp-s2.exeCode function: 0_2_00007FF6D09F1B500_2_00007FF6D09F1B50
            Source: C:\Users\user\Desktop\wp-s2.exeCode function: 0_2_00007FF6D09F5D300_2_00007FF6D09F5D30
            Source: C:\Users\user\Desktop\wp-s2.exeCode function: 0_2_00007FF6D09EA4740_2_00007FF6D09EA474
            Source: C:\Users\user\Desktop\wp-s2.exeCode function: 0_2_00007FF6D09EACAD0_2_00007FF6D09EACAD
            Source: C:\Users\user\Desktop\wp-s2.exeCode function: 0_2_00007FF6D09FE5700_2_00007FF6D09FE570
            Source: C:\Users\user\Desktop\wp-s2.exeCode function: 0_2_00007FF6D09F1D540_2_00007FF6D09F1D54
            Source: C:\Users\user\Desktop\wp-s2.exeCode function: 0_2_00007FF6D09F35A00_2_00007FF6D09F35A0
            Source: C:\Users\user\Desktop\wp-s2.exeCode function: 0_2_00007FF6D09FDEF00_2_00007FF6D09FDEF0
            Source: C:\Users\user\Desktop\wp-s2.exeCode function: 0_2_00007FF6D0A097280_2_00007FF6D0A09728
            Source: C:\Users\user\Desktop\wp-s2.exeCode function: 0_2_00007FF6D09F9EA00_2_00007FF6D09F9EA0
            Source: C:\Users\user\Desktop\wp-s2.exeCode function: 0_2_00007FF6D0A05E7C0_2_00007FF6D0A05E7C
            Source: C:\Users\user\Desktop\wp-s2.exeCode function: 0_2_00007FF6D09E98000_2_00007FF6D09E9800
            Source: C:\Users\user\Desktop\wp-s2.exeCode function: 0_2_00007FF6D09F1F600_2_00007FF6D09F1F60
            Source: C:\Users\user\Desktop\wp-s2.exeCode function: 0_2_00007FF6D09F17400_2_00007FF6D09F1740
            Source: C:\Users\user\Desktop\wp-s2.exeCode function: 0_2_00007FF6D09F87940_2_00007FF6D09F8794
            Source: C:\Users\user\Desktop\wp-s2.exeCode function: 0_2_00007FF6D09F80E40_2_00007FF6D09F80E4
            Source: C:\Users\user\Desktop\wp-s2.exeCode function: 0_2_00007FF6D0A018740_2_00007FF6D0A01874
            Source: C:\Users\user\Desktop\wp-s2.exeCode function: 0_2_00007FF6D0A040AC0_2_00007FF6D0A040AC
            Source: C:\Users\user\Desktop\wp-s2.exeCode function: 1_2_00007FF6D0A069641_2_00007FF6D0A06964
            Source: C:\Users\user\Desktop\wp-s2.exeCode function: 1_2_00007FF6D09E10001_2_00007FF6D09E1000
            Source: C:\Users\user\Desktop\wp-s2.exeCode function: 1_2_00007FF6D09E89E01_2_00007FF6D09E89E0
            Source: C:\Users\user\Desktop\wp-s2.exeCode function: 1_2_00007FF6D09F21641_2_00007FF6D09F2164
            Source: C:\Users\user\Desktop\wp-s2.exeCode function: 1_2_00007FF6D09F19441_2_00007FF6D09F1944
            Source: C:\Users\user\Desktop\wp-s2.exeCode function: 1_2_00007FF6D09F39A41_2_00007FF6D09F39A4
            Source: C:\Users\user\Desktop\wp-s2.exeCode function: 1_2_00007FF6D09EA2DB1_2_00007FF6D09EA2DB
            Source: C:\Users\user\Desktop\wp-s2.exeCode function: String function: 00007FF6D09E2710 appears 92 times
            Source: C:\Users\user\Desktop\wp-s2.exeProcess created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 6752 -s 940
            Source: unicodedata.pyd.0.drStatic PE information: Resource name: RT_VERSION type: COM executable for DOS
            Source: python3.dll.0.drStatic PE information: No import functions for PE file found
            Source: wp-s2.exe, 00000000.00000003.1744869654.000001D2961A5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamepython3.dll. vs wp-s2.exe
            Source: wp-s2.exe, 00000000.00000003.1695666686.000001D2961A4000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameQt5Network.dll( vs wp-s2.exe
            Source: wp-s2.exe, 00000000.00000003.1747633937.000001D2961A5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameunicodedata.pyd. vs wp-s2.exe
            Source: wp-s2.exe, 00000000.00000003.1738961170.000001D2961A5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_bz2.pyd. vs wp-s2.exe
            Source: wp-s2.exe, 00000000.00000003.1716926948.000001D2961A4000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameqicns.dll( vs wp-s2.exe
            Source: wp-s2.exe, 00000000.00000003.1739924950.000001D2961A5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_lzma.pyd. vs wp-s2.exe
            Source: wp-s2.exe, 00000000.00000003.1697273457.000001D2961A4000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameQt5QmlModels.dll( vs wp-s2.exe
            Source: wp-s2.exe, 00000000.00000003.1719480565.000001D2961A4000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameqwindows.dll( vs wp-s2.exe
            Source: wp-s2.exe, 00000000.00000003.1740078161.000001D2961A5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_queue.pyd. vs wp-s2.exe
            Source: wp-s2.exe, 00000000.00000003.1740872836.000001D2961A5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_ssl.pyd. vs wp-s2.exe
            Source: wp-s2.exe, 00000000.00000003.1698741421.000001D2961A4000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameQt5Svg.dll( vs wp-s2.exe
            Source: wp-s2.exe, 00000000.00000003.1716792661.000001D2961A4000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameqgif.dll( vs wp-s2.exe
            Source: wp-s2.exe, 00000000.00000003.1740181136.000001D2961A5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_socket.pyd. vs wp-s2.exe
            Source: wp-s2.exe, 00000000.00000003.1718862315.000001D2961A4000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameqoffscreen.dll( vs wp-s2.exe
            Source: wp-s2.exe, 00000000.00000003.1717803010.000001D2961A4000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameqtiff.dll( vs wp-s2.exe
            Source: wp-s2.exe, 00000000.00000003.1704773732.000001D2961A4000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamelibGLESv2.dll4 vs wp-s2.exe
            Source: wp-s2.exe, 00000000.00000003.1691739148.000001D2961A4000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameQt5Core.dll( vs wp-s2.exe
            Source: wp-s2.exe, 00000000.00000003.1694229514.000001D2961A4000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameQt5Gui.dll( vs wp-s2.exe
            Source: wp-s2.exe, 00000000.00000003.1698906239.000001D2961A4000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameQt5WebSockets.dll( vs wp-s2.exe
            Source: wp-s2.exe, 00000000.00000003.1718524179.000001D2961A4000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameqminimal.dll( vs wp-s2.exe
            Source: wp-s2.exe, 00000000.00000003.1744214545.000001D2961A5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamelibsslH vs wp-s2.exe
            Source: wp-s2.exe, 00000000.00000003.1704282045.000001D2961A4000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename vs wp-s2.exe
            Source: wp-s2.exe, 00000000.00000003.1704282045.000001D2961A4000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamelibEGL.dll. vs wp-s2.exe
            Source: wp-s2.exe, 00000000.00000003.1692963511.000001D2961A4000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameQt5DBus.dll( vs wp-s2.exe
            Source: wp-s2.exe, 00000000.00000003.1717172660.000001D2961A4000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameqjpeg.dll( vs wp-s2.exe
            Source: wp-s2.exe, 00000000.00000003.1718025414.000001D2961A4000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameqwbmp.dll( vs wp-s2.exe
            Source: wp-s2.exe, 00000000.00000003.1717538177.000001D2961A4000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameqtga.dll( vs wp-s2.exe
            Source: wp-s2.exe, 00000000.00000003.1719838444.000001D2961A5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameqxdgdesktopportal.dll( vs wp-s2.exe
            Source: wp-s2.exe, 00000000.00000003.1717040182.000001D2961A4000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameqico.dll( vs wp-s2.exe
            Source: wp-s2.exe, 00000000.00000003.1716509121.000001D2961A4000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameqtuiotouchplugin.dll( vs wp-s2.exe
            Source: wp-s2.exe, 00000000.00000003.1739421344.000001D2961A5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_ctypes.pyd. vs wp-s2.exe
            Source: wp-s2.exe, 00000000.00000003.1747354150.000001D2961A5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameselect.pyd. vs wp-s2.exe
            Source: wp-s2.exe, 00000000.00000003.1700785114.000001D2961A4000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamevcruntime140.dllT vs wp-s2.exe
            Source: wp-s2.exe, 00000000.00000003.1739600157.000001D2961A5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_decimal.pyd. vs wp-s2.exe
            Source: wp-s2.exe, 00000000.00000003.1719961624.000001D2961A5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameqwindowsvistastyle.dll( vs wp-s2.exe
            Source: wp-s2.exe, 00000000.00000003.1701014707.000001D2961A4000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamevcruntime140_1.dllT vs wp-s2.exe
            Source: wp-s2.exe, 00000000.00000003.1741028108.000001D2961A5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_wmi.pyd. vs wp-s2.exe
            Source: wp-s2.exe, 00000000.00000003.1690791747.000001D2961A2000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamemsvcp140.dllT vs wp-s2.exe
            Source: wp-s2.exe, 00000000.00000003.1719137863.000001D2961A4000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameqwebgl.dll( vs wp-s2.exe
            Source: wp-s2.exe, 00000000.00000003.1738003483.000001D2961A5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamevcruntime140.dllT vs wp-s2.exe
            Source: wp-s2.exe, 00000000.00000003.1716671349.000001D2961A4000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameqsvgicon.dll( vs wp-s2.exe
            Source: wp-s2.exe, 00000000.00000003.1738782073.000001D2961A5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamevcruntime140_1.dllT vs wp-s2.exe
            Source: wp-s2.exe, 00000000.00000003.1696311204.000001D2961A4000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameQt5Qml.dll( vs wp-s2.exe
            Source: wp-s2.exe, 00000000.00000003.1718192942.000001D2961A4000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameqwebp.dll( vs wp-s2.exe
            Source: wp-s2.exe, 00000000.00000003.1691042886.000001D2961A4000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamemsvcp140_1.dllT vs wp-s2.exe
            Source: wp-s2.exe, 00000000.00000003.1717401705.000001D2961A4000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameqsvg.dll( vs wp-s2.exe
            Source: wp-s2.exe, 00000000.00000003.1739775823.000001D2961A5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_hashlib.pyd. vs wp-s2.exe
            Source: wp-s2.exeBinary or memory string: OriginalFilename vs wp-s2.exe
            Source: wp-s2.exe, 00000001.00000002.2094578869.00007FFE1152A000.00000002.00000001.01000000.00000013.sdmpBinary or memory string: OriginalFilename_ssl.pyd. vs wp-s2.exe
            Source: wp-s2.exe, 00000001.00000002.2087828503.00007FFDFA1F3000.00000002.00000001.01000000.0000001D.sdmpBinary or memory string: OriginalFilenameQt5Widgets.dll( vs wp-s2.exe
            Source: wp-s2.exe, 00000001.00000002.2095582327.00007FFE12E19000.00000002.00000001.01000000.0000000F.sdmpBinary or memory string: OriginalFilenamevcruntime140_1.dllT vs wp-s2.exe
            Source: wp-s2.exe, 00000001.00000002.2095910612.00007FFE13312000.00000002.00000001.01000000.00000009.sdmpBinary or memory string: OriginalFilename_bz2.pyd. vs wp-s2.exe
            Source: wp-s2.exe, 00000001.00000002.2085998704.00007FFDF93AB000.00000002.00000001.01000000.00000020.sdmpBinary or memory string: OriginalFilenameqwindows.dll( vs wp-s2.exe
            Source: wp-s2.exe, 00000001.00000002.2093882249.00007FFE0EB62000.00000002.00000001.01000000.00000021.sdmpBinary or memory string: OriginalFilenameqwindowsvistastyle.dll( vs wp-s2.exe
            Source: wp-s2.exe, 00000001.00000002.2081582775.000001B81E0B0000.00000002.00000001.01000000.00000006.sdmpBinary or memory string: OriginalFilenamepython3.dll. vs wp-s2.exe
            Source: wp-s2.exe, 00000001.00000002.2095692010.00007FFE130C6000.00000002.00000001.01000000.0000000E.sdmpBinary or memory string: OriginalFilenamemsvcp140_1.dllT vs wp-s2.exe
            Source: wp-s2.exe, 00000001.00000002.2095805735.00007FFE1321E000.00000002.00000001.01000000.00000007.sdmpBinary or memory string: OriginalFilename_ctypes.pyd. vs wp-s2.exe
            Source: wp-s2.exe, 00000001.00000002.2093293184.00007FFE0146F000.00000002.00000001.01000000.0000000D.sdmpBinary or memory string: OriginalFilenamemsvcp140.dllT vs wp-s2.exe
            Source: wp-s2.exe, 00000001.00000002.2094863635.00007FFE11BB6000.00000002.00000001.01000000.00000017.sdmpBinary or memory string: OriginalFilename_queue.pyd. vs wp-s2.exe
            Source: wp-s2.exe, 00000001.00000002.2092558523.00007FFDFBAC0000.00000002.00000001.01000000.00000004.sdmpBinary or memory string: OriginalFilenamepython313.dll. vs wp-s2.exe
            Source: wp-s2.exe, 00000001.00000002.2092828879.00007FFE0082C000.00000002.00000001.01000000.0000001A.sdmpBinary or memory string: OriginalFilenameunicodedata.pyd. vs wp-s2.exe
            Source: wp-s2.exe, 00000001.00000002.2089805565.00007FFDFAC24000.00000002.00000001.01000000.00000014.sdmpBinary or memory string: OriginalFilenamelibcryptoH vs wp-s2.exe
            Source: wp-s2.exe, 00000001.00000002.2095013627.00007FFE11EB3000.00000002.00000001.01000000.00000011.sdmpBinary or memory string: OriginalFilename_socket.pyd. vs wp-s2.exe
            Source: wp-s2.exe, 00000001.00000002.2095236631.00007FFE120CD000.00000002.00000001.01000000.00000016.sdmpBinary or memory string: OriginalFilename_hashlib.pyd. vs wp-s2.exe
            Source: wp-s2.exe, 00000001.00000002.2090562181.00007FFDFB190000.00000002.00000001.01000000.0000000C.sdmpBinary or memory string: OriginalFilenameQt5Core.dll( vs wp-s2.exe
            Source: wp-s2.exe, 00000001.00000002.2093031370.00007FFE013D0000.00000002.00000001.01000000.00000015.sdmpBinary or memory string: OriginalFilenamelibsslH vs wp-s2.exe
            Source: wp-s2.exe, 00000001.00000002.2095343615.00007FFE126C6000.00000002.00000001.01000000.00000012.sdmpBinary or memory string: OriginalFilenameselect.pyd. vs wp-s2.exe
            Source: wp-s2.exe, 00000001.00000002.2095473571.00007FFE126F3000.00000002.00000001.01000000.0000000A.sdmpBinary or memory string: OriginalFilename_lzma.pyd. vs wp-s2.exe
            Source: wp-s2.exe, 00000001.00000002.2081407541.000001B81C7D8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameD3D10Warp.dllj% vs wp-s2.exe
            Source: wp-s2.exe, 00000001.00000002.2087287876.00007FFDF9CA9000.00000002.00000001.01000000.0000001E.sdmpBinary or memory string: OriginalFilenameQt5Gui.dll( vs wp-s2.exe
            Source: wp-s2.exe, 00000001.00000002.2096125200.00007FFE1A46A000.00000002.00000001.01000000.00000005.sdmpBinary or memory string: OriginalFilenamevcruntime140.dllT vs wp-s2.exe
            Source: Qt5Core.dll.0.drStatic PE information: Section: .qtmimed ZLIB complexity 0.997458770800317
            Source: classification engineClassification label: mal68.troj.spyw.evad.winEXE@13/142@1/1
            Source: C:\Users\user\Desktop\wp-s2.exeMutant created: NULL
            Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6996:120:WilError_03
            Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5936:120:WilError_03
            Source: C:\Windows\System32\WerFault.exeMutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6752
            Source: C:\Users\user\Desktop\wp-s2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI65242Jump to behavior
            Source: wp-s2.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
            Source: C:\Windows\System32\systeminfo.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
            Source: C:\Windows\System32\systeminfo.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
            Source: C:\Users\user\Desktop\wp-s2.exeKey opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
            Source: wp-s2.exeVirustotal: Detection: 8%
            Source: wp-s2.exeString found in binary or memory: <!--StartFragment-->
            Source: C:\Users\user\Desktop\wp-s2.exeFile read: C:\Users\user\Desktop\wp-s2.exeJump to behavior
            Source: unknownProcess created: C:\Users\user\Desktop\wp-s2.exe "C:\Users\user\Desktop\wp-s2.exe"
            Source: C:\Users\user\Desktop\wp-s2.exeProcess created: C:\Users\user\Desktop\wp-s2.exe "C:\Users\user\Desktop\wp-s2.exe"
            Source: C:\Users\user\Desktop\wp-s2.exeProcess created: C:\Windows\System32\systeminfo.exe systeminfo
            Source: C:\Windows\System32\systeminfo.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Windows\System32\systeminfo.exeProcess created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
            Source: C:\Users\user\Desktop\wp-s2.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic computersystem get manufacturer"
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wbem\WMIC.exe wmic computersystem get manufacturer
            Source: C:\Users\user\Desktop\wp-s2.exeProcess created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 6752 -s 940
            Source: C:\Users\user\Desktop\wp-s2.exeProcess created: C:\Users\user\Desktop\wp-s2.exe "C:\Users\user\Desktop\wp-s2.exe"Jump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeProcess created: C:\Windows\System32\systeminfo.exe systeminfoJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic computersystem get manufacturer"Jump to behavior
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wbem\WMIC.exe wmic computersystem get manufacturerJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeSection loaded: uxtheme.dllJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeSection loaded: kernel.appcore.dllJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeSection loaded: version.dllJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeSection loaded: vcruntime140.dllJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeSection loaded: libffi-8.dllJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeSection loaded: qt5core.dllJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeSection loaded: mpr.dllJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeSection loaded: userenv.dllJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeSection loaded: netapi32.dllJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeSection loaded: winmm.dllJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeSection loaded: msvcp140.dllJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeSection loaded: msvcp140_1.dllJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeSection loaded: vcruntime140_1.dllJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeSection loaded: vcruntime140_1.dllJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeSection loaded: netutils.dllJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeSection loaded: srvcli.dllJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeSection loaded: cryptbase.dllJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeSection loaded: iphlpapi.dllJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeSection loaded: libcrypto-3.dllJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeSection loaded: libssl-3.dllJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeSection loaded: mswsock.dllJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeSection loaded: powrprof.dllJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeSection loaded: pdh.dllJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeSection loaded: umpdc.dllJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeSection loaded: wtsapi32.dllJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeSection loaded: qt5widgets.dllJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeSection loaded: qt5gui.dllJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeSection loaded: qt5gui.dllJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeSection loaded: uxtheme.dllJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeSection loaded: dwmapi.dllJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeSection loaded: d3d11.dllJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeSection loaded: dxgi.dllJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeSection loaded: kernel.appcore.dllJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeSection loaded: windows.storage.dllJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeSection loaded: wldp.dllJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeSection loaded: profapi.dllJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeSection loaded: d3d9.dllJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeSection loaded: d3d10warp.dllJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeSection loaded: dataexchange.dllJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeSection loaded: dcomp.dllJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeSection loaded: twinapi.appcore.dllJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeSection loaded: dnsapi.dllJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeSection loaded: rasadhlp.dllJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeSection loaded: fwpuclnt.dllJump to behavior
            Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: fastprox.dllJump to behavior
            Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: ncobjapi.dllJump to behavior
            Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: kernel.appcore.dllJump to behavior
            Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: userenv.dllJump to behavior
            Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: sspicli.dllJump to behavior
            Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: ntmarta.dllJump to behavior
            Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: esscli.dllJump to behavior
            Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: iphlpapi.dllJump to behavior
            Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: framedynos.dllJump to behavior
            Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: sspicli.dllJump to behavior
            Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: kernel.appcore.dllJump to behavior
            Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: msxml6.dllJump to behavior
            Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: urlmon.dllJump to behavior
            Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: iertutil.dllJump to behavior
            Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: srvcli.dllJump to behavior
            Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: netutils.dllJump to behavior
            Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: uxtheme.dllJump to behavior
            Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: vcruntime140.dllJump to behavior
            Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: vcruntime140_1.dllJump to behavior
            Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: amsi.dllJump to behavior
            Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: userenv.dllJump to behavior
            Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: profapi.dllJump to behavior
            Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: vbscript.dllJump to behavior
            Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: sxs.dllJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9FC8E510-A27C-4B3B-B9A3-BF65F00256A8}\InProcServer32Jump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeProcess created: C:\Windows\System32\systeminfo.exe systeminfo
            Source: Window RecorderWindow detected: More than 3 window changes detected
            Source: wp-s2.exeStatic PE information: Image base 0x140000000 > 0x60000000
            Source: wp-s2.exeStatic file information: File size 38752565 > 1048576
            Source: wp-s2.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
            Source: wp-s2.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
            Source: wp-s2.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
            Source: wp-s2.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
            Source: wp-s2.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
            Source: wp-s2.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
            Source: wp-s2.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
            Source: wp-s2.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
            Source: Binary string: C:\Users\qt\work\qt\qtsvg\plugins\iconengines\qsvgicon.pdb source: wp-s2.exe, 00000000.00000003.1716671349.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: C:\Users\qt\work\qt\qtsvg\plugins\imageformats\qsvg.pdb source: wp-s2.exe, 00000000.00000003.1717401705.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\generic\qtuiotouchplugin.pdb source: wp-s2.exe, 00000000.00000003.1716509121.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: d:\agent\_work\1\s\\binaries\amd64ret\bin\amd64\\msvcp140.amd64.pdb source: wp-s2.exe, 00000001.00000002.2093179483.00007FFE01435000.00000002.00000001.01000000.0000000D.sdmp
            Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\imageformats\qico.pdb source: wp-s2.exe, 00000000.00000003.1717040182.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG"OpenSSL 3.0.15 3 Sep 20243.0.15built on: Wed Sep 4 15:52:04 2024 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-3"MODULESDIR: "C:\Program Files\OpenSSL\lib\ossl-modules"CPUINFO: N/Anot availableget_and_lock..\s\crypto\ex_data.cossl_crypto_get_ex_new_index_exossl_crypto_new_ex_data_exCRYPTO_dup_ex_dataCRYPTO_set_ex_dataOPENSSL_WIN32_UTF8..\s\crypto\getenv.ccompiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG";CPUINFO: OPENSSL_ia32cap=0x%llx:0x%llxOPENSSL_ia32cap env:%sos-specificC:\Program Files\Common Files\SSLC:\Program Files\OpenSSL\lib\ossl-modules.dllCPUINFO: ..\s\crypto\init.cOPENSSL_init_cryptoOPENSSL_atexit..\s\crypto\initthread.c..\s\crypto\mem_sec.cassertion failed: (bit & 1) == 0assertion failed: list >= 0 && list < sh.freelist_sizeassertion failed: ((ptr - sh.arena) & ((sh.arena_size >> list) - 1)) == 0assertion failed: bit > 0 && bit < sh.bittable_sizeassertion failed: TESTBIT(table, bit)assertion failed: !TESTBIT(table, bit)assertion failed: WITHIN_FREELIST(list)assertion failed: WITHIN_ARENA(ptr)assertion failed: temp->next == NULL || WITHIN_ARENA(temp->next)assertion failed: (char **)temp->next->p_next == listassertion failed: WITHIN_FREELIST(temp2->p_next) || WITHIN_ARENA(temp2->p_next)assertion failed: size > 0assertion failed: (size & (size - 1)) == 0assertion failed: (minsize & (minsize - 1)) == 0assertion failed: sh.freelist != NULLassertion failed: sh.bittable != NULLassertion failed: sh.bitmalloc != NULLassertion failed: !sh_testbit(temp, slist, sh.bitmalloc)assertion failed: temp != sh.freelist[slist]assertion failed: sh.freelist[slist] == tempassertion failed: temp-(sh.arena_size >> slist) == sh_find_my_buddy(temp, slist)assertion failed: sh_testbit(chunk, list, sh.bittable)assertion failed: WITHIN_ARENA(chunk)assertion failed: sh_testbit(ptr, list, sh.bittable)assertion failed: ptr == sh_find_my_buddy(buddy, list)assertion failed: ptr != NULLassertion failed: !sh_testbit(ptr, list, sh.bitmalloc)assertion failed: sh.freelist[list] == ptr/*0123456789ABCDEFCRYPTO_memdup..\s\crypto\o_str.chexstr2buf_sepossl_hexstr2buf_sepbuf2hexstr_sepossl_buf2hexstr_sep..\s\crypto\packet.cwpacket_intern_init_lenWPACKET_start_sub_packet_len__..\s\crypto\param_build.cparam_pushparam_push_numOSSL_PARAM_BLD_push_BN_padNegative big numbers are unsupported for OSSL_PARAMOSSL_PARAM_BLD_push_utf8_stringOSSL_PARAM_BLD_push_utf8_ptrOSSL_PARAM_BLD_push_octet_stringOSSL_PARAM_BLD_p
            Source: Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG" source: wp-s2.exe, 00000001.00000002.2089508974.00007FFDFAAE2000.00000002.00000001.01000000.00000014.sdmp
            Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdbGCTL source: wp-s2.exe, 00000000.00000003.1738003483.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2096082906.00007FFE1A464000.00000002.00000001.01000000.00000005.sdmp
            Source: Binary string: d:\agent\_work\1\s\\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdb source: wp-s2.exe, 00000000.00000003.1701014707.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2095539658.00007FFE12E15000.00000002.00000001.01000000.0000000F.sdmp
            Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdb source: wp-s2.exe, 00000000.00000003.1738782073.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\styles\qwindowsvistastyle.pdb%% source: wp-s2.exe, 00000001.00000002.2093601265.00007FFE0EB57000.00000002.00000001.01000000.00000021.sdmp
            Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\styles\qwindowsvistastyle.pdb source: wp-s2.exe, 00000001.00000002.2093601265.00007FFE0EB57000.00000002.00000001.01000000.00000021.sdmp
            Source: Binary string: D:\a\1\b\bin\amd64\_ctypes.pdb source: wp-s2.exe, 00000001.00000002.2095760829.00007FFE13213000.00000002.00000001.01000000.00000007.sdmp
            Source: Binary string: D:\a\1\b\bin\amd64\_hashlib.pdb source: wp-s2.exe, 00000000.00000003.1739775823.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2095195470.00007FFE120C6000.00000002.00000001.01000000.00000016.sdmp
            Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\imageformats\qico.pdb source: wp-s2.exe, 00000000.00000003.1717040182.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\generic\qtuiotouchplugin.pdb source: wp-s2.exe, 00000000.00000003.1716509121.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: C:\Users\qt\work\qt\qtbase\lib\Qt5Core.pdbT source: wp-s2.exe, 00000001.00000002.2090128814.00007FFDFB0B6000.00000002.00000001.01000000.0000000C.sdmp
            Source: Binary string: C:\Users\qt\work\qt\qtbase\lib\Qt5Gui.pdb source: wp-s2.exe, 00000001.00000002.2087013621.00007FFDF9A2A000.00000002.00000001.01000000.0000001E.sdmp
            Source: Binary string: D:\a\1\b\bin\amd64\_lzma.pdb source: wp-s2.exe, 00000000.00000003.1739924950.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2095410985.00007FFE126EB000.00000002.00000001.01000000.0000000A.sdmp
            Source: Binary string: D:\a\1\b\bin\amd64\_bz2.pdb source: wp-s2.exe, 00000000.00000003.1738961170.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2095869665.00007FFE1330D000.00000002.00000001.01000000.00000009.sdmp
            Source: Binary string: D:\a\1\b\bin\amd64\_socket.pdb source: wp-s2.exe, 00000000.00000003.1740181136.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2094967647.00007FFE11EA9000.00000002.00000001.01000000.00000011.sdmp
            Source: Binary string: D:\a\1\b\bin\amd64\python313.pdb source: wp-s2.exe, 00000001.00000002.2091458277.00007FFDFB888000.00000002.00000001.01000000.00000004.sdmp
            Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdbGCTL source: wp-s2.exe, 00000000.00000003.1738782073.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: d:\agent\_work\1\s\\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: wp-s2.exe, 00000000.00000003.1700785114.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: C:\Users\qt\work\qt\qtimageformats\plugins\imageformats\qtiff.pdbBB source: wp-s2.exe, 00000000.00000003.1717803010.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\platformthemes\qxdgdesktopportal.pdb source: wp-s2.exe, 00000000.00000003.1719838444.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: D:\a\1\b\bin\amd64\unicodedata.pdb source: wp-s2.exe, 00000000.00000003.1747633937.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2092647545.00007FFE00827000.00000002.00000001.01000000.0000001A.sdmp
            Source: Binary string: d:\agent\_work\1\s\\binaries\amd64ret\bin\amd64\\msvcp140_1.amd64.pdb source: wp-s2.exe, 00000000.00000003.1691042886.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2095651317.00007FFE130C3000.00000002.00000001.01000000.0000000E.sdmp
            Source: Binary string: D:\a\1\b\libcrypto-3.pdb| source: wp-s2.exe, 00000001.00000002.2089508974.00007FFDFAB7A000.00000002.00000001.01000000.00000014.sdmp
            Source: Binary string: D:\a\1\b\libssl-3.pdbDD source: wp-s2.exe, 00000001.00000002.2092970035.00007FFE01395000.00000002.00000001.01000000.00000015.sdmp
            Source: Binary string: C:\Users\qt\work\qt\qtbase\lib\Qt5Core.pdb source: wp-s2.exe, 00000001.00000002.2090128814.00007FFDFB0B6000.00000002.00000001.01000000.0000000C.sdmp
            Source: Binary string: C:\Users\qt\work\qt\qtimageformats\plugins\imageformats\qtiff.pdb source: wp-s2.exe, 00000000.00000003.1717803010.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\imageformats\qgif.pdb source: wp-s2.exe, 00000000.00000003.1716792661.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: D:\a\1\b\bin\amd64\_wmi.pdb(('GCTL source: wp-s2.exe, 00000000.00000003.1741028108.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: C:\Users\qt\work\qt\qtimageformats\plugins\imageformats\qtga.pdb source: wp-s2.exe, 00000000.00000003.1717538177.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: wp-s2.exe, 00000000.00000003.1738003483.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2096082906.00007FFE1A464000.00000002.00000001.01000000.00000005.sdmp
            Source: Binary string: D:\a\1\b\libcrypto-3.pdb source: wp-s2.exe, 00000001.00000002.2089508974.00007FFDFAB7A000.00000002.00000001.01000000.00000014.sdmp
            Source: Binary string: C:\Users\qt\work\qt\qtimageformats\plugins\imageformats\qicns.pdb source: wp-s2.exe, 00000000.00000003.1716926948.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: D:\a\1\b\bin\amd64\select.pdb source: wp-s2.exe, 00000000.00000003.1747354150.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2095303412.00007FFE126C3000.00000002.00000001.01000000.00000012.sdmp
            Source: Binary string: D:\a\1\b\bin\amd64\_lzma.pdbNN source: wp-s2.exe, 00000000.00000003.1739924950.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2095410985.00007FFE126EB000.00000002.00000001.01000000.0000000A.sdmp
            Source: Binary string: D:\a\1\b\bin\amd64\_queue.pdb source: wp-s2.exe, 00000000.00000003.1740078161.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2094786013.00007FFE11BB3000.00000002.00000001.01000000.00000017.sdmp
            Source: Binary string: D:\a\1\b\bin\amd64\_wmi.pdb source: wp-s2.exe, 00000000.00000003.1741028108.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: C:\Users\qt\work\qt\qtbase\lib\Qt5Widgets.pdb source: wp-s2.exe, 00000001.00000002.2087602644.00007FFDFA02A000.00000002.00000001.01000000.0000001D.sdmp
            Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\platforms\qwindows.pdb source: wp-s2.exe, 00000001.00000002.2085851674.00007FFDF9344000.00000002.00000001.01000000.00000020.sdmp
            Source: Binary string: D:\a\1\b\bin\amd64\python3.pdb source: wp-s2.exe, 00000000.00000003.1744869654.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2081582775.000001B81E0B0000.00000002.00000001.01000000.00000006.sdmp
            Source: Binary string: C:\Users\qt\work\qt\qtimageformats\plugins\imageformats\qwbmp.pdb source: wp-s2.exe, 00000000.00000003.1718025414.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: C:\Users\qt\work\qt\qtbase\lib\libEGL.pdb source: wp-s2.exe, 00000000.00000003.1704282045.000001D2961A4000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: D:\a\1\b\libssl-3.pdb source: wp-s2.exe, 00000001.00000002.2092970035.00007FFE01395000.00000002.00000001.01000000.00000015.sdmp
            Source: Binary string: D:\a\1\b\bin\amd64\_ssl.pdb source: wp-s2.exe, 00000001.00000002.2094441421.00007FFE1150E000.00000002.00000001.01000000.00000013.sdmp
            Source: wp-s2.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
            Source: wp-s2.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
            Source: wp-s2.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
            Source: wp-s2.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
            Source: wp-s2.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata
            Source: VCRUNTIME140.dll.0.drStatic PE information: 0x78BDDED1 [Sat Mar 11 17:01:05 2034 UTC]
            Source: VCRUNTIME140.dll.0.drStatic PE information: section name: fothk
            Source: VCRUNTIME140.dll.0.drStatic PE information: section name: _RDATA
            Source: VCRUNTIME140.dll0.0.drStatic PE information: section name: _RDATA
            Source: opengl32sw.dll.0.drStatic PE information: section name: _RDATA
            Source: qtuiotouchplugin.dll.0.drStatic PE information: section name: .qtmetad
            Source: qsvgicon.dll.0.drStatic PE information: section name: .qtmetad
            Source: MSVCP140.dll.0.drStatic PE information: section name: .didat
            Source: Qt5Core.dll.0.drStatic PE information: section name: .qtmimed
            Source: libcrypto-3.dll.0.drStatic PE information: section name: .00cfg
            Source: qgif.dll.0.drStatic PE information: section name: .qtmetad
            Source: qicns.dll.0.drStatic PE information: section name: .qtmetad
            Source: qico.dll.0.drStatic PE information: section name: .qtmetad
            Source: qjpeg.dll.0.drStatic PE information: section name: .qtmetad
            Source: qsvg.dll.0.drStatic PE information: section name: .qtmetad
            Source: qtga.dll.0.drStatic PE information: section name: .qtmetad
            Source: qtiff.dll.0.drStatic PE information: section name: .qtmetad
            Source: qwbmp.dll.0.drStatic PE information: section name: .qtmetad
            Source: qwebp.dll.0.drStatic PE information: section name: .qtmetad
            Source: qminimal.dll.0.drStatic PE information: section name: .qtmetad
            Source: libssl-3.dll.0.drStatic PE information: section name: .00cfg
            Source: python313.dll.0.drStatic PE information: section name: PyRuntim
            Source: qoffscreen.dll.0.drStatic PE information: section name: .qtmetad
            Source: qwebgl.dll.0.drStatic PE information: section name: .qtmetad
            Source: qwindows.dll.0.drStatic PE information: section name: .qtmetad
            Source: qxdgdesktopportal.dll.0.drStatic PE information: section name: .qtmetad
            Source: qwindowsvistastyle.dll.0.drStatic PE information: section name: .qtmetad
            Source: C:\Users\user\Desktop\wp-s2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI65242\_queue.pydJump to dropped file
            Source: C:\Users\user\Desktop\wp-s2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\bin\opengl32sw.dllJump to dropped file
            Source: C:\Users\user\Desktop\wp-s2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\plugins\imageformats\qico.dllJump to dropped file
            Source: C:\Users\user\Desktop\wp-s2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\bin\Qt5Qml.dllJump to dropped file
            Source: C:\Users\user\Desktop\wp-s2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\sip.cp313-win_amd64.pydJump to dropped file
            Source: C:\Users\user\Desktop\wp-s2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\plugins\iconengines\qsvgicon.dllJump to dropped file
            Source: C:\Users\user\Desktop\wp-s2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI65242\python3.dllJump to dropped file
            Source: C:\Users\user\Desktop\wp-s2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI65242\charset_normalizer\md.cp313-win_amd64.pydJump to dropped file
            Source: C:\Users\user\Desktop\wp-s2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\plugins\platforms\qoffscreen.dllJump to dropped file
            Source: C:\Users\user\Desktop\wp-s2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\bin\Qt5WebSockets.dllJump to dropped file
            Source: C:\Users\user\Desktop\wp-s2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\plugins\imageformats\qjpeg.dllJump to dropped file
            Source: C:\Users\user\Desktop\wp-s2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\bin\VCRUNTIME140_1.dllJump to dropped file
            Source: C:\Users\user\Desktop\wp-s2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\QtGui.pydJump to dropped file
            Source: C:\Users\user\Desktop\wp-s2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI65242\charset_normalizer\md__mypyc.cp313-win_amd64.pydJump to dropped file
            Source: C:\Users\user\Desktop\wp-s2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\plugins\generic\qtuiotouchplugin.dllJump to dropped file
            Source: C:\Users\user\Desktop\wp-s2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI65242\psutil\_psutil_windows.pydJump to dropped file
            Source: C:\Users\user\Desktop\wp-s2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\plugins\styles\qwindowsvistastyle.dllJump to dropped file
            Source: C:\Users\user\Desktop\wp-s2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI65242\VCRUNTIME140_1.dllJump to dropped file
            Source: C:\Users\user\Desktop\wp-s2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\bin\libGLESv2.dllJump to dropped file
            Source: C:\Users\user\Desktop\wp-s2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\QtWidgets.pydJump to dropped file
            Source: C:\Users\user\Desktop\wp-s2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\bin\Qt5Core.dllJump to dropped file
            Source: C:\Users\user\Desktop\wp-s2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\QtCore.pydJump to dropped file
            Source: C:\Users\user\Desktop\wp-s2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\bin\d3dcompiler_47.dllJump to dropped file
            Source: C:\Users\user\Desktop\wp-s2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI65242\_ssl.pydJump to dropped file
            Source: C:\Users\user\Desktop\wp-s2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\plugins\imageformats\qtiff.dllJump to dropped file
            Source: C:\Users\user\Desktop\wp-s2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\plugins\imageformats\qwebp.dllJump to dropped file
            Source: C:\Users\user\Desktop\wp-s2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\plugins\platforms\qwebgl.dllJump to dropped file
            Source: C:\Users\user\Desktop\wp-s2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\bin\libEGL.dllJump to dropped file
            Source: C:\Users\user\Desktop\wp-s2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI65242\_wmi.pydJump to dropped file
            Source: C:\Users\user\Desktop\wp-s2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\bin\MSVCP140_1.dllJump to dropped file
            Source: C:\Users\user\Desktop\wp-s2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\bin\Qt5Widgets.dllJump to dropped file
            Source: C:\Users\user\Desktop\wp-s2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI65242\_ctypes.pydJump to dropped file
            Source: C:\Users\user\Desktop\wp-s2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI65242\VCRUNTIME140.dllJump to dropped file
            Source: C:\Users\user\Desktop\wp-s2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\plugins\imageformats\qgif.dllJump to dropped file
            Source: C:\Users\user\Desktop\wp-s2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\bin\Qt5DBus.dllJump to dropped file
            Source: C:\Users\user\Desktop\wp-s2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\bin\MSVCP140.dllJump to dropped file
            Source: C:\Users\user\Desktop\wp-s2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI65242\libffi-8.dllJump to dropped file
            Source: C:\Users\user\Desktop\wp-s2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI65242\_bz2.pydJump to dropped file
            Source: C:\Users\user\Desktop\wp-s2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI65242\_socket.pydJump to dropped file
            Source: C:\Users\user\Desktop\wp-s2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\bin\Qt5QmlModels.dllJump to dropped file
            Source: C:\Users\user\Desktop\wp-s2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\bin\Qt5Network.dllJump to dropped file
            Source: C:\Users\user\Desktop\wp-s2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI65242\select.pydJump to dropped file
            Source: C:\Users\user\Desktop\wp-s2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\bin\Qt5Quick.dllJump to dropped file
            Source: C:\Users\user\Desktop\wp-s2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\plugins\imageformats\qtga.dllJump to dropped file
            Source: C:\Users\user\Desktop\wp-s2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\plugins\platforms\qwindows.dllJump to dropped file
            Source: C:\Users\user\Desktop\wp-s2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI65242\_hashlib.pydJump to dropped file
            Source: C:\Users\user\Desktop\wp-s2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\plugins\imageformats\qwbmp.dllJump to dropped file
            Source: C:\Users\user\Desktop\wp-s2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\plugins\platformthemes\qxdgdesktopportal.dllJump to dropped file
            Source: C:\Users\user\Desktop\wp-s2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI65242\_lzma.pydJump to dropped file
            Source: C:\Users\user\Desktop\wp-s2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\bin\VCRUNTIME140.dllJump to dropped file
            Source: C:\Users\user\Desktop\wp-s2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI65242\libcrypto-3.dllJump to dropped file
            Source: C:\Users\user\Desktop\wp-s2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\plugins\imageformats\qsvg.dllJump to dropped file
            Source: C:\Users\user\Desktop\wp-s2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI65242\python313.dllJump to dropped file
            Source: C:\Users\user\Desktop\wp-s2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI65242\_decimal.pydJump to dropped file
            Source: C:\Users\user\Desktop\wp-s2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\bin\Qt5Svg.dllJump to dropped file
            Source: C:\Users\user\Desktop\wp-s2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\plugins\imageformats\qicns.dllJump to dropped file
            Source: C:\Users\user\Desktop\wp-s2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\plugins\platforms\qminimal.dllJump to dropped file
            Source: C:\Users\user\Desktop\wp-s2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI65242\unicodedata.pydJump to dropped file
            Source: C:\Users\user\Desktop\wp-s2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\bin\Qt5Gui.dllJump to dropped file
            Source: C:\Users\user\Desktop\wp-s2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI65242\libssl-3.dllJump to dropped file
            Source: C:\Users\user\Desktop\wp-s2.exeCode function: 0_2_00007FF6D09E76C0 GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,0_2_00007FF6D09E76C0
            Source: C:\Users\user\Desktop\wp-s2.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\systeminfo.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\wbem\WMIC.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOXJump to behavior
            Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOXJump to behavior
            Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOXJump to behavior
            Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOXJump to behavior
            Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOXJump to behavior
            Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

            Malware Analysis System Evasion

            barindex
            Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
            Source: C:\Windows\System32\systeminfo.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapter
            Source: C:\Users\user\Desktop\wp-s2.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI65242\_queue.pydJump to dropped file
            Source: C:\Users\user\Desktop\wp-s2.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\plugins\imageformats\qico.dllJump to dropped file
            Source: C:\Users\user\Desktop\wp-s2.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\bin\opengl32sw.dllJump to dropped file
            Source: C:\Users\user\Desktop\wp-s2.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\bin\Qt5Qml.dllJump to dropped file
            Source: C:\Users\user\Desktop\wp-s2.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\sip.cp313-win_amd64.pydJump to dropped file
            Source: C:\Users\user\Desktop\wp-s2.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\plugins\iconengines\qsvgicon.dllJump to dropped file
            Source: C:\Users\user\Desktop\wp-s2.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI65242\python3.dllJump to dropped file
            Source: C:\Users\user\Desktop\wp-s2.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI65242\charset_normalizer\md.cp313-win_amd64.pydJump to dropped file
            Source: C:\Users\user\Desktop\wp-s2.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\plugins\platforms\qoffscreen.dllJump to dropped file
            Source: C:\Users\user\Desktop\wp-s2.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\bin\Qt5WebSockets.dllJump to dropped file
            Source: C:\Users\user\Desktop\wp-s2.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\plugins\imageformats\qjpeg.dllJump to dropped file
            Source: C:\Users\user\Desktop\wp-s2.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\QtGui.pydJump to dropped file
            Source: C:\Users\user\Desktop\wp-s2.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI65242\charset_normalizer\md__mypyc.cp313-win_amd64.pydJump to dropped file
            Source: C:\Users\user\Desktop\wp-s2.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\plugins\generic\qtuiotouchplugin.dllJump to dropped file
            Source: C:\Users\user\Desktop\wp-s2.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI65242\psutil\_psutil_windows.pydJump to dropped file
            Source: C:\Users\user\Desktop\wp-s2.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\plugins\styles\qwindowsvistastyle.dllJump to dropped file
            Source: C:\Users\user\Desktop\wp-s2.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\bin\libGLESv2.dllJump to dropped file
            Source: C:\Users\user\Desktop\wp-s2.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\QtWidgets.pydJump to dropped file
            Source: C:\Users\user\Desktop\wp-s2.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\QtCore.pydJump to dropped file
            Source: C:\Users\user\Desktop\wp-s2.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\bin\d3dcompiler_47.dllJump to dropped file
            Source: C:\Users\user\Desktop\wp-s2.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI65242\_ssl.pydJump to dropped file
            Source: C:\Users\user\Desktop\wp-s2.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\plugins\imageformats\qtiff.dllJump to dropped file
            Source: C:\Users\user\Desktop\wp-s2.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\plugins\platforms\qwebgl.dllJump to dropped file
            Source: C:\Users\user\Desktop\wp-s2.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\plugins\imageformats\qwebp.dllJump to dropped file
            Source: C:\Users\user\Desktop\wp-s2.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\bin\libEGL.dllJump to dropped file
            Source: C:\Users\user\Desktop\wp-s2.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI65242\_wmi.pydJump to dropped file
            Source: C:\Users\user\Desktop\wp-s2.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI65242\_ctypes.pydJump to dropped file
            Source: C:\Users\user\Desktop\wp-s2.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\plugins\imageformats\qgif.dllJump to dropped file
            Source: C:\Users\user\Desktop\wp-s2.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\bin\Qt5DBus.dllJump to dropped file
            Source: C:\Users\user\Desktop\wp-s2.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI65242\_socket.pydJump to dropped file
            Source: C:\Users\user\Desktop\wp-s2.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI65242\_bz2.pydJump to dropped file
            Source: C:\Users\user\Desktop\wp-s2.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\bin\Qt5QmlModels.dllJump to dropped file
            Source: C:\Users\user\Desktop\wp-s2.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\bin\Qt5Network.dllJump to dropped file
            Source: C:\Users\user\Desktop\wp-s2.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI65242\select.pydJump to dropped file
            Source: C:\Users\user\Desktop\wp-s2.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\bin\Qt5Quick.dllJump to dropped file
            Source: C:\Users\user\Desktop\wp-s2.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\plugins\imageformats\qtga.dllJump to dropped file
            Source: C:\Users\user\Desktop\wp-s2.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\plugins\platforms\qwindows.dllJump to dropped file
            Source: C:\Users\user\Desktop\wp-s2.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI65242\_hashlib.pydJump to dropped file
            Source: C:\Users\user\Desktop\wp-s2.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\plugins\imageformats\qwbmp.dllJump to dropped file
            Source: C:\Users\user\Desktop\wp-s2.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\plugins\platformthemes\qxdgdesktopportal.dllJump to dropped file
            Source: C:\Users\user\Desktop\wp-s2.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI65242\_lzma.pydJump to dropped file
            Source: C:\Users\user\Desktop\wp-s2.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\plugins\imageformats\qsvg.dllJump to dropped file
            Source: C:\Users\user\Desktop\wp-s2.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI65242\python313.dllJump to dropped file
            Source: C:\Users\user\Desktop\wp-s2.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI65242\_decimal.pydJump to dropped file
            Source: C:\Users\user\Desktop\wp-s2.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\plugins\imageformats\qicns.dllJump to dropped file
            Source: C:\Users\user\Desktop\wp-s2.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\plugins\platforms\qminimal.dllJump to dropped file
            Source: C:\Users\user\Desktop\wp-s2.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\bin\Qt5Svg.dllJump to dropped file
            Source: C:\Users\user\Desktop\wp-s2.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI65242\unicodedata.pydJump to dropped file
            Source: C:\Users\user\Desktop\wp-s2.exeEvasive API call chain: GetModuleFileName,DecisionNodes,ExitProcessgraph_1-3648
            Source: C:\Users\user\Desktop\wp-s2.exeCheck user administrative privileges: GetTokenInformation,DecisionNodesgraph_0-17415
            Source: C:\Windows\System32\systeminfo.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
            Source: C:\Windows\System32\wbem\WMIC.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Manufacturer FROM Win32_ComputerSystem
            Source: C:\Windows\System32\systeminfo.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
            Source: C:\Windows\System32\systeminfo.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
            Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
            Source: C:\Users\user\Desktop\wp-s2.exeCode function: 0_2_00007FF6D09E9280 FindFirstFileExW,FindClose,0_2_00007FF6D09E9280
            Source: C:\Users\user\Desktop\wp-s2.exeCode function: 0_2_00007FF6D09E83C0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,0_2_00007FF6D09E83C0
            Source: C:\Users\user\Desktop\wp-s2.exeCode function: 0_2_00007FF6D0A01874 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,0_2_00007FF6D0A01874
            Source: C:\Users\user\Desktop\wp-s2.exeCode function: 1_2_00007FF6D09E9280 FindFirstFileExW,FindClose,1_2_00007FF6D09E9280
            Source: C:\Windows\System32\WerFault.exeFile opened: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\bin\Jump to behavior
            Source: C:\Windows\System32\WerFault.exeFile opened: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\Jump to behavior
            Source: C:\Windows\System32\WerFault.exeFile opened: C:\Users\user\AppData\Local\Jump to behavior
            Source: C:\Windows\System32\WerFault.exeFile opened: C:\Users\user\AppData\Jump to behavior
            Source: C:\Windows\System32\WerFault.exeFile opened: C:\Users\user\Jump to behavior
            Source: C:\Windows\System32\WerFault.exeFile opened: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Jump to behavior
            Source: wp-s2.exe, 00000000.00000003.1741579600.000001D2961A5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: j2aTPs+9xYa9+bG3tD60B8jzljHz7aRP+KNOjSkVWLjVb3/ubCK1sK9IRQq9qEmU
            Source: wp-s2.exe, 00000001.00000003.1755036913.000001B81EABA000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1755864798.000001B81EABD000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: QEMUr
            Source: wp-s2.exe, 00000001.00000003.1757204060.000001B81E73F000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1758008751.000001B81E73F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
            Source: wp-s2.exe, 00000001.00000002.2082080905.000001B81E650000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
            Source: wp-s2.exe, 00000001.00000002.2087212203.00007FFDF9C98000.00000008.00000001.01000000.0000001E.sdmpBinary or memory string: .?AVQEmulationPaintEngine@@
            Source: wp-s2.exe, 00000001.00000002.2082426797.000001B81E950000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: bfQEMU
            Source: C:\Users\user\Desktop\wp-s2.exeAPI call chain: ExitProcess graph end nodegraph_1-3657
            Source: C:\Users\user\Desktop\wp-s2.exeProcess information queried: ProcessInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeCode function: 0_2_00007FF6D09FA614 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_00007FF6D09FA614
            Source: C:\Users\user\Desktop\wp-s2.exeCode function: 0_2_00007FF6D0A03480 GetProcessHeap,0_2_00007FF6D0A03480
            Source: C:\Users\user\Desktop\wp-s2.exeProcess token adjusted: DebugJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeProcess token adjusted: DebugJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeCode function: 0_2_00007FF6D09ED30C SetUnhandledExceptionFilter,0_2_00007FF6D09ED30C
            Source: C:\Users\user\Desktop\wp-s2.exeCode function: 0_2_00007FF6D09FA614 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_00007FF6D09FA614
            Source: C:\Users\user\Desktop\wp-s2.exeCode function: 0_2_00007FF6D09ED12C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_00007FF6D09ED12C
            Source: C:\Users\user\Desktop\wp-s2.exeCode function: 0_2_00007FF6D09EC8A0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,0_2_00007FF6D09EC8A0
            Source: C:\Users\user\Desktop\wp-s2.exeProcess created: C:\Users\user\Desktop\wp-s2.exe "C:\Users\user\Desktop\wp-s2.exe"Jump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeProcess created: C:\Windows\System32\systeminfo.exe systeminfoJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic computersystem get manufacturer"Jump to behavior
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wbem\WMIC.exe wmic computersystem get manufacturerJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeCode function: 0_2_00007FF6D0A09570 cpuid 0_2_00007FF6D0A09570
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\bin VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\bin VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\bin VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\plugins VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\plugins VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\plugins\imageformats VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\plugins\imageformats VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\plugins\imageformats VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\plugins\platforms VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\translations VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\translations VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\translations VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\translations VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\translations VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\translations VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\translations VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\translations VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\translations VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\translations VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\translations VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\translations VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\translations VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\translations VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\translations VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\translations VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\translations VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\translations VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\translations VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\translations VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\translations VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\translations VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\translations VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\translations VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\translations VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\translations VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\translations VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\translations VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\translations VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\translations VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\translations VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\certifi VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\charset_normalizer VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\_ctypes.pyd VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\_bz2.pyd VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\_lzma.pyd VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\QtCore.pyd VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\sip.cp313-win_amd64.pyd VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\_socket.pyd VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\select.pyd VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\_hashlib.pyd VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\_queue.pyd VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\charset_normalizer VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\charset_normalizer VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\charset_normalizer VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\charset_normalizer VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\charset_normalizer\md__mypyc.cp313-win_amd64.pyd VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\certifi VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\psutil VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\psutil VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\psutil VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\psutil\_psutil_windows.pyd VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\QtWidgets.pyd VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\QtGui.pyd VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\plugins\platforms\qminimal.dll VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\plugins\platforms\qoffscreen.dll VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\plugins\platforms\qwebgl.dll VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\plugins\platformthemes\qxdgdesktopportal.dll VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\plugins\styles\qwindowsvistastyle.dll VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI65242 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\wp-s2.exeCode function: 0_2_00007FF6D09ED010 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,0_2_00007FF6D09ED010
            Source: C:\Users\user\Desktop\wp-s2.exeCode function: 0_2_00007FF6D0A05C00 _get_daylight,_get_daylight,_get_daylight,_get_daylight,_get_daylight,GetTimeZoneInformation,0_2_00007FF6D0A05C00

            Stealing of Sensitive Information

            barindex
            Yara detected Python BackDoor
            Source: Yara matchFile source: 00000001.00000002.2082080905.000001B81E841000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000001.00000003.1755036913.000001B81EABA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000001.00000003.1755225796.000001B81E7F6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000001.00000003.1758008751.000001B81E7F6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000001.00000003.1755864798.000001B81EABD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000001.00000003.1757583955.000001B81E7F6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000001.00000003.1756150289.000001B81E7F6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000001.00000002.2082516614.000001B81EAA1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000001.00000003.1757204060.000001B81E7F6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: Process Memory Space: wp-s2.exe PID: 6752, type: MEMORYSTR
            Opens network shares
            Source: C:\Users\user\Desktop\wp-s2.exeFile opened: \\Mac\shared\projects\loader\src\dropper\src\tmp\_main.pyJump to behavior

            Remote Access Functionality

            barindex
            Yara detected Python BackDoor
            Source: Yara matchFile source: 00000001.00000002.2082080905.000001B81E841000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000001.00000003.1755036913.000001B81EABA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000001.00000003.1755225796.000001B81E7F6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000001.00000003.1758008751.000001B81E7F6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000001.00000003.1755864798.000001B81EABD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000001.00000003.1757583955.000001B81E7F6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000001.00000003.1756150289.000001B81E7F6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000001.00000002.2082516614.000001B81EAA1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000001.00000003.1757204060.000001B81E7F6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: Process Memory Space: wp-s2.exe PID: 6752, type: MEMORYSTR

            Mitre Att&ck Matrix

            ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
            Gather Victim Identity InformationAcquire InfrastructureValid Accounts131
            Windows Management Instrumentation            		1
            DLL Side-Loading            		11
            Process Injection            		12
            Virtualization/Sandbox Evasion            		OS Credential Dumping1
            Network Share Discovery            		Remote Services1
            Archive Collected Data            		12
            Encrypted Channel            		Exfiltration Over Other Network MediumAbuse Accessibility Features
            CredentialsDomainsDefault Accounts2
            Command and Scripting Interpreter            		Boot or Logon Initialization Scripts1
            DLL Side-Loading            		11
            Process Injection            		LSASS Memory2
            System Time Discovery            		Remote Desktop ProtocolData from Removable Media1
            Non-Application Layer Protocol            		Exfiltration Over BluetoothNetwork Denial of Service
            Email AddressesDNS ServerDomain Accounts2
            Native API            		Logon Script (Windows)Logon Script (Windows)1
            Deobfuscate/Decode Files or Information            		Security Account Manager141
            Security Software Discovery            		SMB/Windows Admin SharesData from Network Shared Drive2
            Application Layer Protocol            		Automated ExfiltrationData Encrypted for Impact
            Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook1
            Obfuscated Files or Information            		NTDS12
            Virtualization/Sandbox Evasion            		Distributed Component Object ModelInput CaptureProtocol ImpersonationTraffic DuplicationData Destruction
            Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script1
            Software Packing            		LSA Secrets1
            Process Discovery            		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
            Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts1
            Timestomp            		Cached Domain Credentials2
            File and Directory Discovery            		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
            DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items1
            DLL Side-Loading            		DCSync44
            System Information Discovery            		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery

            Behavior Graph

            Hide Legend

            Legend:

            • Process
            • Signature
            • Created File
            • DNS/IP Info
            • Is Dropped
            • Is Windows Process
            • Number of created Registry Values
            • Number of created Files
            • Visual Basic
            • Delphi
            • Java
            • .Net C# or VB.NET
            • C, C++ or other language
            • Is malicious
            • Internet
            behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1578736 Sample: wp-s2.exe Startdate: 20/12/2024 Architecture: WINDOWS Score: 68 42 nodejs.org 2->42 48 Multi AV Scanner detection for submitted file 2->48 50 Yara detected Python BackDoor 2->50 52 AI detected suspicious sample 2->52 9 wp-s2.exe 153 2->9         started        signatures3 process4 file5 34 C:\Users\user\AppData\...\unicodedata.pyd, PE32+ 9->34 dropped 36 C:\Users\user\AppData\Local\...\select.pyd, PE32+ 9->36 dropped 38 C:\Users\user\AppData\Local\...\python313.dll, PE32+ 9->38 dropped 40 57 other files (none is malicious) 9->40 dropped 12 wp-s2.exe 9->12         started        process6 dnsIp7 44 nodejs.org 104.20.22.46, 443, 49731 CLOUDFLARENETUS United States 12->44 54 Opens network shares 12->54 16 systeminfo.exe 2 1 12->16         started        19 WerFault.exe 19 16 12->19         started        22 cmd.exe 1 12->22         started        signatures8 process9 file10 46 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 16->46 24 WmiPrvSE.exe 16->24         started        26 conhost.exe 16->26         started        32 C:\ProgramData\Microsoft\...\Report.wer, Unicode 19->32 dropped 28 WMIC.exe 1 22->28         started        30 conhost.exe 22->30         started        signatures11 process12

            Screenshots

            Thumbnails

            This section contains all screenshots as thumbnails, including those not shown in the slideshow.


            windows-stand

            Antivirus, Machine Learning and Genetic Malware Detection

            Initial Sample

            SourceDetectionScannerLabelLink
            wp-s2.exe8%VirustotalBrowse
            wp-s2.exe5%ReversingLabsWin64.Trojan.Generic

            Dropped Files

            SourceDetectionScannerLabelLink
            C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\bin\MSVCP140.dll0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\bin\MSVCP140_1.dll0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\bin\Qt5Core.dll0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\bin\Qt5DBus.dll0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\bin\Qt5Gui.dll0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\bin\Qt5Network.dll0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\bin\Qt5Qml.dll0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\bin\Qt5QmlModels.dll0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\bin\Qt5Quick.dll0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\bin\Qt5Svg.dll0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\bin\Qt5WebSockets.dll0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\bin\Qt5Widgets.dll0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\bin\VCRUNTIME140.dll0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\bin\VCRUNTIME140_1.dll0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\bin\d3dcompiler_47.dll3%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\bin\libEGL.dll0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\bin\libGLESv2.dll0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\bin\opengl32sw.dll0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\plugins\generic\qtuiotouchplugin.dll0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\plugins\iconengines\qsvgicon.dll0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\plugins\imageformats\qgif.dll0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\plugins\imageformats\qicns.dll0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\plugins\imageformats\qico.dll0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\plugins\imageformats\qjpeg.dll0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\plugins\imageformats\qsvg.dll0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\plugins\imageformats\qtga.dll0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\plugins\imageformats\qtiff.dll0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\plugins\imageformats\qwbmp.dll0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\plugins\imageformats\qwebp.dll0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\plugins\platforms\qminimal.dll0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\plugins\platforms\qoffscreen.dll0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\plugins\platforms\qwebgl.dll0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\plugins\platforms\qwindows.dll0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\plugins\platformthemes\qxdgdesktopportal.dll0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\plugins\styles\qwindowsvistastyle.dll0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\QtCore.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\QtGui.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\QtWidgets.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\sip.cp313-win_amd64.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI65242\VCRUNTIME140.dll0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI65242\VCRUNTIME140_1.dll0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI65242\_bz2.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI65242\_ctypes.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI65242\_decimal.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI65242\_hashlib.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI65242\_lzma.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI65242\_queue.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI65242\_socket.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI65242\_ssl.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI65242\_wmi.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI65242\charset_normalizer\md.cp313-win_amd64.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI65242\charset_normalizer\md__mypyc.cp313-win_amd64.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI65242\libcrypto-3.dll0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI65242\libffi-8.dll0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI65242\libssl-3.dll0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI65242\psutil\_psutil_windows.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI65242\python3.dll0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI65242\python313.dll0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI65242\select.pyd0%ReversingLabs

            Unpacked PE Files

            ⊘No Antivirus matches

            Domains

            ⊘No Antivirus matches

            URLs

            ⊘No Antivirus matches

            Domains and IPs

            Contacted Domains

            NameIPActiveMaliciousAntivirus DetectionReputation
            nodejs.org
            		104.20.22.46
            		truefalse
              		high

              URLs from Memory and Binaries

              NameSourceMaliciousAntivirus DetectionReputation
              https://github.com/giampaolo/psutil/issues/875.wp-s2.exe, 00000001.00000002.2084943619.000001B81FBF4000.00000004.00001000.00020000.00000000.sdmpfalse
                		high
                https://nodejs.org/dist/v22.11.0/node-v22.11.0-win-x64.zipwp-s2.exe, 00000001.00000002.2082426797.000001B81E950000.00000004.00001000.00020000.00000000.sdmpfalse
                  		high
                  https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#wp-s2.exe, 00000001.00000002.2081888920.000001B81E310000.00000004.00000020.00020000.00000000.sdmpfalse
                    		high
                    https://packaging.python.org/en/latest/specifications/recording-installed-packages/#the-record-filewp-s2.exe, 00000001.00000002.2082080905.000001B81E782000.00000004.00000020.00020000.00000000.sdmpfalse
                      		high
                      http://goo.gl/zeJZl.wp-s2.exe, 00000001.00000002.2083815498.000001B81F3B0000.00000004.00001000.00020000.00000000.sdmpfalse
                        		high
                        https://tools.ietf.org/html/rfc2388#section-4.4wp-s2.exe, 00000001.00000003.1762017406.000001B81EBA5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1759396614.000001B81EBA5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2082516614.000001B81EBA5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1781570040.000001B81EBA5000.00000004.00000020.00020000.00000000.sdmpfalse
                          		high
                          https://docs.python.org/3.11/library/binascii.html#binascii.a2b_base64wp-s2.exe, 00000001.00000002.2081888920.000001B81E310000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1760549875.000001B81E3D2000.00000004.00000020.00020000.00000000.sdmpfalse
                            		high
                            https://packaging.python.org/en/latest/specifications/entry-points/#file-formatwp-s2.exe, 00000001.00000002.2082080905.000001B81E782000.00000004.00000020.00020000.00000000.sdmpfalse
                              		high
                              https://github.com/urllib3/urllib3/issues/2192#issuecomment-821832963wp-s2.exe, 00000001.00000002.2082516614.000001B81EBFC000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1781570040.000001B81EBFC000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1760937335.000001B81EC02000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2083312157.000001B81EE70000.00000004.00001000.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1759396614.000001B81EC02000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1765860509.000001B81EBFC000.00000004.00000020.00020000.00000000.sdmpfalse
                                		high
                                http://cacerts.digiwp-s2.exe, 00000000.00000003.1747633937.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1740872836.000001D2961A5000.00000004.00000020.00020000.00000000.sdmpfalse
                                  		high
                                  https://peps.python.org/pep-0205/wp-s2.exe, 00000001.00000002.2082321401.000001B81E850000.00000004.00001000.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1756150289.000001B81E7BC000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1750070545.000001B81E311000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1757204060.000001B81E78C000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1755225796.000001B81E7BC000.00000004.00000020.00020000.00000000.sdmpfalse
                                    		high
                                    http://crl.dhimyotis.com/certignarootca.crlwp-s2.exe, 00000001.00000003.1781570040.000001B81EE1D000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2082516614.000001B81EE1B000.00000004.00000020.00020000.00000000.sdmpfalse
                                      		high
                                      http://curl.haxx.se/rfc/cookie_spec.htmlwp-s2.exe, 00000001.00000003.1759279653.000001B81ECE8000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2083678251.000001B81F1C0000.00000004.00001000.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1759279653.000001B81ED43000.00000004.00000020.00020000.00000000.sdmpfalse
                                        		high
                                        http://ocsp.accv.eswp-s2.exe, 00000001.00000002.2082516614.000001B81EDBA000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1786232962.000001B81EDBA000.00000004.00000020.00020000.00000000.sdmpfalse
                                          		high
                                          http://repository.swisssign.com/Ywp-s2.exe, 00000001.00000003.1781570040.000001B81EC52000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2082516614.000001B81EC52000.00000004.00000020.00020000.00000000.sdmpfalse
                                            		unknown
                                            http://www.cert.fnmt.es/dpcs/K$wp-s2.exe, 00000001.00000003.1781570040.000001B81EE1D000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2082516614.000001B81EE1B000.00000004.00000020.00020000.00000000.sdmpfalse
                                              		high
                                              https://docs.python.org/3/library/importlib.html#importlib.abc.ExecutionLoader.get_filenamewp-s2.exe, 00000001.00000002.2081660537.000001B81E110000.00000004.00001000.00020000.00000000.sdmpfalse
                                                		high
                                                https://urllib3.readthedocs.io/en/latest/advanced-usage.html#https-proxy-error-http-proxywp-s2.exe, 00000001.00000002.2083478692.000001B81EF90000.00000004.00001000.00020000.00000000.sdmpfalse
                                                  		high
                                                  https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688wp-s2.exe, 00000001.00000002.2081660537.000001B81E194000.00000004.00001000.00020000.00000000.sdmpfalse
                                                    		high
                                                    https://httpbin.org/getwp-s2.exe, 00000001.00000002.2083678251.000001B81F1C0000.00000004.00001000.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2082516614.000001B81EC52000.00000004.00000020.00020000.00000000.sdmpfalse
                                                      		high
                                                      https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.get_codewp-s2.exe, 00000001.00000002.2081660537.000001B81E110000.00000004.00001000.00020000.00000000.sdmpfalse
                                                        		high
                                                        https://wwww.certigna.fr/autorites/0mwp-s2.exe, 00000001.00000003.1781570040.000001B81EE1D000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2082516614.000001B81EE1B000.00000004.00000020.00020000.00000000.sdmpfalse
                                                          		high
                                                          https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/readerwp-s2.exe, 00000001.00000002.2081888920.000001B81E310000.00000004.00000020.00020000.00000000.sdmpfalse
                                                            		high
                                                            https://github.com/python/cpython/issues/86361.wp-s2.exe, 00000001.00000003.1754622319.000001B81E803000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1754674201.000001B81E7FC000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1756150289.000001B81E7BC000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1758008751.000001B81E78C000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2082080905.000001B81E782000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1757204060.000001B81E78C000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1755225796.000001B81E7BC000.00000004.00000020.00020000.00000000.sdmpfalse
                                                              		high
                                                              http://mail.python.org/pipermail/python-dev/2012-June/120787.html.wp-s2.exe, 00000001.00000002.2083678251.000001B81F1C0000.00000004.00001000.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2082516614.000001B81EC52000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                		high
                                                                https://httpbin.org/wp-s2.exe, 00000001.00000002.2082516614.000001B81EC52000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                  		high
                                                                  https://wwww.certigna.fr/autorites/wp-s2.exe, 00000001.00000003.1781570040.000001B81EE1D000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2082516614.000001B81EE1B000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                    		high
                                                                    https://docs.python.org/3/library/importlib.html#importlib.abc.Loader.exec_modulewp-s2.exe, 00000001.00000002.2081660537.000001B81E110000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                      		high
                                                                      https://docs.python.org/3/library/importlib.html#importlib.abc.MetaPathFinder.invalidate_cacheswp-s2.exe, 00000001.00000002.2081660537.000001B81E110000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                        		high
                                                                        http://www.color.org)wp-s2.exe, 00000001.00000002.2087013621.00007FFDF9A2A000.00000002.00000001.01000000.0000001E.sdmpfalse
                                                                          		high
                                                                          http://hg.python.org/cpython/file/603b4d593758/Lib/socket.py#l535wp-s2.exe, 00000001.00000002.2082516614.000001B81EBFC000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1781570040.000001B81EBFC000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1760937335.000001B81EC02000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1759396614.000001B81EC02000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2082516614.000001B81EAA1000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1765860509.000001B81EBFC000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                            		high
                                                                            https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sywp-s2.exe, 00000001.00000002.2081888920.000001B81E310000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                              		high
                                                                              https://packaging.python.org/en/latest/specifications/core-metadata/#core-metadatawp-s2.exe, 00000001.00000002.2083573190.000001B81F090000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                		high
                                                                                http://crl.securetrust.com/STCA.crlwp-s2.exe, 00000001.00000002.2082516614.000001B81EDBA000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1786232962.000001B81EDBA000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                  		high
                                                                                  http://wwwsearch.sf.net/):wp-s2.exe, 00000001.00000003.1760937335.000001B81ECC7000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1759279653.000001B81ECE8000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1783712261.000001B81ECB6000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1759396614.000001B81ECC7000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2082516614.000001B81ECB6000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1765860509.000001B81ECB6000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1759279653.000001B81ED43000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                    		high
                                                                                    https://github.com/python/importlib_metadata/wiki/Development-Methodologywp-s2.exe, 00000001.00000002.2082426797.000001B81E950000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                      		high
                                                                                      http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1.crt0wp-s2.exe, 00000001.00000002.2082516614.000001B81EDBA000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1781570040.000001B81EE1D000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1786232962.000001B81EDBA000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2082516614.000001B81EE1B000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                        		high
                                                                                        http://www.accv.es/legislacion_c.htmwp-s2.exe, 00000001.00000002.2082516614.000001B81EDBA000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1786232962.000001B81EDBA000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                          		high
                                                                                          http://tools.ietf.org/html/rfc6125#section-6.4.3wp-s2.exe, 00000001.00000002.2083573190.000001B81F090000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                            		high
                                                                                            http://crl.xrampsecurity.com/XGCA.crl0wp-s2.exe, 00000001.00000003.1781570040.000001B81EC52000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2082516614.000001B81EC52000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                              		high
                                                                                              http://www.cert.fnmt.es/dpcs/wp-s2.exe, 00000001.00000003.1781570040.000001B81EE1D000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2081888920.000001B81E310000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2082516614.000001B81EE1B000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                		high
                                                                                                https://google.com/mailwp-s2.exe, 00000001.00000003.1760589925.000001B81EC7C000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1765860509.000001B81EC52000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2082080905.000001B81E650000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1781570040.000001B81EC52000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1762017406.000001B81EC52000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1760937335.000001B81EC52000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2082516614.000001B81EC52000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                  		high
                                                                                                  https://packaging.python.org/specifications/entry-points/wp-s2.exe, 00000001.00000002.2083478692.000001B81EF90000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                    		high
                                                                                                    http://www.accv.es00wp-s2.exe, 00000001.00000002.2082516614.000001B81EDBA000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1781570040.000001B81EE1D000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1786232962.000001B81EDBA000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2082516614.000001B81EE1B000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                      		high
                                                                                                      https://www.python.org/psf/license/)wp-s2.exe, 00000001.00000002.2091458277.00007FFDFB888000.00000002.00000001.01000000.00000004.sdmpfalse
                                                                                                        		high
                                                                                                        https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.pywp-s2.exe, 00000001.00000002.2081888920.000001B81E310000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                          		high
                                                                                                          https://foss.heptapod.net/pypy/pypy/-/issues/3539wp-s2.exe, 00000001.00000002.2083312157.000001B81EE70000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                            		high
                                                                                                            https://github.com/urllib3/urllib3/issues/2513#issuecomment-1152559900.wp-s2.exe, 00000001.00000003.1760589925.000001B81EC7C000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1761764389.000001B81ECA7000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1781570040.000001B81EB46000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2082516614.000001B81EB46000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1760937335.000001B81EB46000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1760937335.000001B81EC52000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                              		high
                                                                                                              http://google.com/wp-s2.exe, 00000001.00000002.2082080905.000001B81E782000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                		high
                                                                                                                https://mahler:8092/site-updates.pywp-s2.exe, 00000001.00000003.1762895106.000001B81ED79000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1783712261.000001B81ED6D000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1760839874.000001B81ED58000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1760907838.000001B81ED5D000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2082516614.000001B81ED68000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                  		high
                                                                                                                  http://crl.securetrust.com/SGCA.crlwp-s2.exe, 00000001.00000002.2082516614.000001B81EDBA000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1786232962.000001B81EDBA000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                    		high
                                                                                                                    http://.../back.jpegwp-s2.exe, 00000001.00000002.2083678251.000001B81F1C0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                      		high
                                                                                                                      https://tools.ietf.org/html/rfc7231#section-4.3.6)wp-s2.exe, 00000001.00000002.2082080905.000001B81E650000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1757135082.000001B81EB76000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1757135082.000001B81EB97000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                        		high
                                                                                                                        https://httpbin.org/postwp-s2.exe, 00000001.00000003.1756636619.000001B81E6CE000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1757583955.000001B81E754000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1756150289.000001B81E754000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1758008751.000001B81E754000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2082080905.000001B81E73E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                          		high
                                                                                                                          https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.get_sourcewp-s2.exe, 00000001.00000002.2081660537.000001B81E194000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                            		high
                                                                                                                            https://github.com/Ousret/charset_normalizerwp-s2.exe, 00000001.00000003.1760589925.000001B81EC7C000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1765860509.000001B81EC52000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1781570040.000001B81EC52000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1762017406.000001B81EC52000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1760937335.000001B81EC52000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2082516614.000001B81EC52000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                              		high
                                                                                                                              http://www.firmaprofesional.com/cps0wp-s2.exe, 00000001.00000003.1781570040.000001B81EE1D000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1781570040.000001B81EC52000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2082516614.000001B81EC52000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2082516614.000001B81EE1B000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                		high
                                                                                                                                https://docs.python.org/3/library/importlib.html#importlib.abc.PathEntryFinder.find_specwp-s2.exe, 00000001.00000002.2081660537.000001B81E110000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                  		high
                                                                                                                                  https://github.com/urllib3/urllib3/issues/2920wp-s2.exe, 00000001.00000002.2083573190.000001B81F090000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                    		high
                                                                                                                                    http://crl.securetrust.com/SGCA.crl0wp-s2.exe, 00000001.00000002.2082516614.000001B81EBA5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1781570040.000001B81EBA5000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                      		high
                                                                                                                                      https://docs.python.org/3/library/importlib.html#importlib.abc.ResourceLoader.get_datawp-s2.exe, 00000001.00000002.2081888920.000001B81E310000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                        		high
                                                                                                                                        https://yahoo.com/wp-s2.exe, 00000001.00000003.1760589925.000001B81EC7C000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1765860509.000001B81EC52000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2082080905.000001B81E650000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1781570040.000001B81EC52000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1762017406.000001B81EC52000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1760937335.000001B81EC52000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2082516614.000001B81EC52000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                          		high
                                                                                                                                          http://crl.securetrust.com/STCA.crl0wp-s2.exe, 00000001.00000002.2082516614.000001B81EBA5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1781570040.000001B81EBA5000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                            		high
                                                                                                                                            http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6wp-s2.exe, 00000001.00000002.2082080905.000001B81E650000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                              		high
                                                                                                                                              https://html.spec.whatwg.org/multipage/wp-s2.exe, 00000001.00000003.1760589925.000001B81EC7C000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1765860509.000001B81EC52000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1781570040.000001B81EC52000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1762017406.000001B81EC52000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1760937335.000001B81EC52000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2082516614.000001B81EC52000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                		high
                                                                                                                                                http://www.quovadisglobal.com/cps0wp-s2.exe, 00000001.00000002.2082516614.000001B81EDBA000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1786232962.000001B81EDBA000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                  		high
                                                                                                                                                  http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crlwp-s2.exe, 00000001.00000002.2082516614.000001B81EDBA000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1786232962.000001B81EDBA000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                    		high
                                                                                                                                                    https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warningswp-s2.exe, 00000001.00000002.2083478692.000001B81EF90000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                      		high
                                                                                                                                                      http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl0wp-s2.exe, 00000001.00000003.1781570040.000001B81EE1D000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2082516614.000001B81EE1B000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                        		high
                                                                                                                                                        https://www.rfc-editor.org/rfc/rfc8259#section-8.1wp-s2.exe, 00000001.00000003.1760589925.000001B81EC7C000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1765860509.000001B81EC52000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2082080905.000001B81E650000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1781570040.000001B81EC52000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1762017406.000001B81EC52000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1760937335.000001B81EC52000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2082516614.000001B81EC52000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                          		high
                                                                                                                                                          https://requests.readthedocs.iowp-s2.exe, 00000001.00000002.2083815498.000001B81F344000.00000004.00001000.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1756636619.000001B81E6CE000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1757583955.000001B81E754000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1756150289.000001B81E754000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1758008751.000001B81E754000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2082080905.000001B81E73E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                            		high
                                                                                                                                                            http://www.quovadisglobal.com/cpsJwp-s2.exe, 00000001.00000002.2082516614.000001B81EDBA000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1786232962.000001B81EDBA000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                              		high
                                                                                                                                                              http://repository.swisssign.com/wp-s2.exe, 00000001.00000002.2082080905.000001B81E782000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2082516614.000001B81EC52000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                		high
                                                                                                                                                                http://crl.xrampsecurity.com/XGCA.crlwp-s2.exe, 00000001.00000002.2082516614.000001B81EDBA000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1786232962.000001B81EDBA000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                  		high
                                                                                                                                                                  https://www.python.orgwp-s2.exe, 00000001.00000003.1756636619.000001B81E6CE000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1757583955.000001B81E754000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1756150289.000001B81E754000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1758008751.000001B81E754000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2082080905.000001B81E73E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                    		high
                                                                                                                                                                    http://code.activestate.com/recipes/577452-a-memoize-decorator-for-instance-methods/wp-s2.exe, 00000001.00000003.1760589925.000001B81EC7C000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1765860509.000001B81EC52000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1781570040.000001B81EC52000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1762017406.000001B81EC52000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1760937335.000001B81EC52000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2082516614.000001B81EC52000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                      		high
                                                                                                                                                                      http://www.accv.es/legislacion_c.htm0Uwp-s2.exe, 00000001.00000003.1781570040.000001B81EE1D000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2082516614.000001B81EE1B000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                        		high
                                                                                                                                                                        http://www.aiim.org/pdfa/ns/id/wp-s2.exe, 00000001.00000002.2087013621.00007FFDF9A2A000.00000002.00000001.01000000.0000001E.sdmpfalse
                                                                                                                                                                          		high
                                                                                                                                                                          http://ocsp.accv.es0wp-s2.exe, 00000001.00000003.1781570040.000001B81EE1D000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2082516614.000001B81EE1B000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                            		high
                                                                                                                                                                            https://www.python.org/wp-s2.exe, 00000001.00000003.1762895106.000001B81ED79000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1783712261.000001B81ED6D000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1760839874.000001B81ED58000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1760907838.000001B81ED5D000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2082516614.000001B81ED68000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                              		high
                                                                                                                                                                              https://json.orgwp-s2.exe, 00000001.00000002.2082516614.000001B81EAA1000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                		high
                                                                                                                                                                                https://docs.python.org/3/howto/mro.html.wp-s2.exe, 00000001.00000002.2081983260.000001B81E550000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                                  		high
                                                                                                                                                                                  https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.is_packagewp-s2.exe, 00000001.00000002.2081660537.000001B81E110000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                                    		high
                                                                                                                                                                                    https://twitter.com/wp-s2.exe, 00000001.00000003.1760589925.000001B81EC7C000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1765860509.000001B81EC52000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1781570040.000001B81EC52000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1762017406.000001B81EC52000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1760937335.000001B81EC52000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2082516614.000001B81EC52000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                      		high
                                                                                                                                                                                      https://stackoverflow.com/questions/4457745#4457745.wp-s2.exe, 00000001.00000002.2084943619.000001B81FBF4000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                                        		high
                                                                                                                                                                                        http://www.quovadisglobal.com/cpswp-s2.exe, 00000001.00000002.2082516614.000001B81EDBA000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1786232962.000001B81EDBA000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                          		high
                                                                                                                                                                                          https://docs.python.org/3/library/importlib.html#importlib.abc.Loader.create_modulewp-s2.exe, 00000001.00000002.2081660537.000001B81E194000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                                            		high
                                                                                                                                                                                            https://google.com/wp-s2.exe, 00000001.00000002.2082516614.000001B81EC52000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                              		high
                                                                                                                                                                                              https://google.com/mail/wp-s2.exe, 00000001.00000003.1760937335.000001B81EC52000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                		high
                                                                                                                                                                                                http://google.com/mail/wp-s2.exe, 00000001.00000002.2081888920.000001B81E310000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1760549875.000001B81E3D2000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                  		high
                                                                                                                                                                                                  https://github.com/urllib3/urllib3/issues/3290wp-s2.exe, 00000001.00000002.2083573190.000001B81F090000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                                                    		high
                                                                                                                                                                                                    http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crlsjwp-s2.exe, 00000001.00000002.2082516614.000001B81EDBA000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1786232962.000001B81EDBA000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                      		high
                                                                                                                                                                                                      https://www.openssl.org/Hwp-s2.exe, 00000000.00000003.1744214545.000001D2961A5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2089805565.00007FFDFAC24000.00000002.00000001.01000000.00000014.sdmp, wp-s2.exe, 00000001.00000002.2093031370.00007FFE013D0000.00000002.00000001.01000000.00000015.sdmpfalse
                                                                                                                                                                                                        		high
                                                                                                                                                                                                        http://crl.certigna.fr/certignarootca.crl01wp-s2.exe, 00000001.00000003.1781570040.000001B81EE1D000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2082516614.000001B81EE1B000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                          		high
                                                                                                                                                                                                          http://www.cert.fnmt.es/dpcs/0wp-s2.exe, 00000001.00000002.2081888920.000001B81E310000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                            		high
                                                                                                                                                                                                            https://peps.python.org/pep-0263/wp-s2.exe, 00000001.00000002.2091458277.00007FFDFB888000.00000002.00000001.01000000.00000004.sdmpfalse
                                                                                                                                                                                                              		high
                                                                                                                                                                                                              https://github.com/psf/requests/pull/6710wp-s2.exe, 00000001.00000002.2083815498.000001B81F344000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                                                                		high

                                                                                                                                                                                                                World Map of Contacted IPs

                                                                                                                                                                                                                • No. of IPs < 25%
                                                                                                                                                                                                                • 25% < No. of IPs < 50%
                                                                                                                                                                                                                • 50% < No. of IPs < 75%
                                                                                                                                                                                                                • 75% < No. of IPs

                                                                                                                                                                                                                Public IPs

                                                                                                                                                                                                                IPDomainCountryFlagASNASN NameMalicious
                                                                                                                                                                                                                104.20.22.46
                                                                                                                                                                                                                		nodejs.orgUnited States
                                                                                                                                                                                                                		13335CLOUDFLARENETUSfalse

                                                                                                                                                                                                                General Information

                                                                                                                                                                                                                Joe Sandbox version:41.0.0 Charoite
                                                                                                                                                                                                                Analysis ID:1578736
                                                                                                                                                                                                                Start date and time:2024-12-20 09:54:09 +01:00
                                                                                                                                                                                                                Joe Sandbox product:CloudBasic
                                                                                                                                                                                                                Overall analysis duration:0h 9m 7s
                                                                                                                                                                                                                Hypervisor based Inspection enabled:false
                                                                                                                                                                                                                Report type:full
                                                                                                                                                                                                                Cookbook file name:default.jbs
                                                                                                                                                                                                                Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                                                                                                                                                                                Number of analysed new started processes analysed:15
                                                                                                                                                                                                                Number of new started drivers analysed:0
                                                                                                                                                                                                                Number of existing processes analysed:0
                                                                                                                                                                                                                Number of existing drivers analysed:0
                                                                                                                                                                                                                Number of injected processes analysed:0
                                                                                                                                                                                                                Technologies:
                                                                                                                                                                                                                • HCA enabled
                                                                                                                                                                                                                • EGA enabled
                                                                                                                                                                                                                • AMSI enabled
                                                                                                                                                                                                                Analysis Mode:default
                                                                                                                                                                                                                Analysis stop reason:Timeout
                                                                                                                                                                                                                Sample name:wp-s2.exe
                                                                                                                                                                                                                Detection:MAL
                                                                                                                                                                                                                Classification:mal68.troj.spyw.evad.winEXE@13/142@1/1
                                                                                                                                                                                                                EGA Information:
                                                                                                                                                                                                                • Successful, ratio: 100%
                                                                                                                                                                                                                HCA Information:
                                                                                                                                                                                                                • Successful, ratio: 77%
                                                                                                                                                                                                                • Number of executed functions: 62
                                                                                                                                                                                                                • Number of non-executed functions: 78
                                                                                                                                                                                                                Cookbook Comments:
                                                                                                                                                                                                                • Found application associated with file extension: .exe

                                                                                                                                                                                                                Warnings

                                                                                                                                                                                                                • Exclude process from analysis (whitelisted): MpCmdRun.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
                                                                                                                                                                                                                • Excluded IPs from analysis (whitelisted): 20.189.173.22, 20.109.210.53, 20.190.177.21, 13.107.246.63
                                                                                                                                                                                                                • Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, login.live.com, otelrules.azureedge.net, blobcollector.events.data.trafficmanager.net, onedsblobprdwus17.westus.cloudapp.azure.com, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
                                                                                                                                                                                                                • Not all processes where analyzed, report is missing behavior information
                                                                                                                                                                                                                • Report size getting too big, too many NtProtectVirtualMemory calls found.

                                                                                                                                                                                                                Simulations

                                                                                                                                                                                                                Behavior and APIs

                                                                                                                                                                                                                TimeTypeDescription
                                                                                                                                                                                                                03:55:11API Interceptor1x Sleep call for process: wp-s2.exe modified
                                                                                                                                                                                                                03:55:12API Interceptor1x Sleep call for process: WMIC.exe modified
                                                                                                                                                                                                                03:55:40API Interceptor1x Sleep call for process: WerFault.exe modified

                                                                                                                                                                                                                Joe Sandbox View / Context

                                                                                                                                                                                                                IPs

                                                                                                                                                                                                                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                                104.20.22.46wp-cent.exeGet hashmaliciousPython BackDoorBrowse
                                                                                                                                                                                                                  wp-cent.exeGet hashmaliciousPython BackDoorBrowse
                                                                                                                                                                                                                    WTvNL75dCr.exeGet hashmaliciousPython BackDoorBrowse
                                                                                                                                                                                                                      WTvNL75dCr.exeGet hashmaliciousPython BackDoorBrowse
                                                                                                                                                                                                                        wmdqEYgW2i.exeGet hashmaliciousDCRat, PureLog Stealer, zgRATBrowse
                                                                                                                                                                                                                          Bootstrapper.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                            download.ps1Get hashmaliciousPython BackDoorBrowse
                                                                                                                                                                                                                              y3x8pjQ1Ci.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                download.ps1Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                  download.ps1Get hashmaliciousUnknownBrowse

                                                                                                                                                                                                                                    Domains

                                                                                                                                                                                                                                    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                                                    nodejs.orgwp-cent.exeGet hashmaliciousPython BackDoorBrowse
                                                                                                                                                                                                                                    • 104.20.22.46
                                                                                                                                                                                                                                    wp-cent.exeGet hashmaliciousPython BackDoorBrowse
                                                                                                                                                                                                                                    • 104.20.22.46
                                                                                                                                                                                                                                    WTvNL75dCr.exeGet hashmaliciousPython BackDoorBrowse
                                                                                                                                                                                                                                    • 104.20.22.46
                                                                                                                                                                                                                                    WTvNL75dCr.exeGet hashmaliciousPython BackDoorBrowse
                                                                                                                                                                                                                                    • 104.20.22.46
                                                                                                                                                                                                                                    wmdqEYgW2i.exeGet hashmaliciousDCRat, PureLog Stealer, zgRATBrowse
                                                                                                                                                                                                                                    • 104.20.22.46
                                                                                                                                                                                                                                    Bootstrapper.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                    • 104.20.22.46
                                                                                                                                                                                                                                    https://f29cc861.solaraweb-alj.pages.dev/download/static/files/Bootstrapper.exeGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                                                    • 104.20.23.46
                                                                                                                                                                                                                                    download.ps1Get hashmaliciousPython BackDoorBrowse
                                                                                                                                                                                                                                    • 104.20.22.46
                                                                                                                                                                                                                                    y3x8pjQ1Ci.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                    • 104.20.22.46

                                                                                                                                                                                                                                    ASNs

                                                                                                                                                                                                                                    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                                                    CLOUDFLARENETUSfile.exeGet hashmaliciousLummaC, Amadey, LummaC Stealer, PureLog Stealer, RHADAMANTHYS, zgRATBrowse
                                                                                                                                                                                                                                    • 104.21.67.146
                                                                                                                                                                                                                                    https://u46509964.ct.sendgrid.net/ls/click?upn=u001.16O0hg1-2FLz1kpPxGHUZbqTUnkidniSFIXbuQ0K27NKGR5E4qQP4y3-2BK2LCxUfHTmD8VAoWu9fqrv96heRY-2BDaw-3D-3DTW9l_kcz-2FW2m7wWBC5iX2nmYizXpnEWoSr8Rc5lqOd2Tm8BrX2ha7XCwhAEdfUnTDQdcFlDoClQCenTHrYqYGrvROsmQGK19xExQ3O8UU0JUBZANb3FsycXG0lXfAeU6Ge3kEKNmMydUTpk2mvytxKM8NWM4-2BCe9md9gsZjY-2FmreGd712h4QJlOUlhQy19VQuOzLTR0hg5YGbygTAwGERJ0n3IsJQDuwHOGcAqA18p5ElbhIowXEJo1-2FUNhaAkl3hll56dS6aJMfJ2Cg7jctNhsypZwMqKm18nIQwqxy0HjDjPtDlRcWFBii-2BIabVdhAMwhtvbY-2BhH45kGHgqL1VbALLhTExLjDfFJ4Mdg1hbx5shtVSm69xnT8S0os3NwgUPcP6MZcGvFpVYjCIpNJRmEhnpApXmFzR0GdBotdIKDeKv3ZVh61As-2FSNo3vfT6a-2F1G6CSiTaxzhsqh2H-2BbaxKc9CNbAVT-2BT7dLfv3mwuz99sF3ZWYAQVhK-2FC3sPsTl5X4hdzGiFwatwFf8YUFBISMNX22jwRHFRxLR66dQgVtYo7IumZ-2FOZfPJ2G3u57Las-2FXsx3SO8XE1W1y4QspPQeH1YjVMsZnAeeR8w-2FvWRwY1A7qeifyIBD1fUq-2B4bmZYMnqZ3q5oEXMCBqA-2Fhiv6OawVXsyA5vOFgFJ9F0GjgBX8N-2FlVTcBHanqEGbxSYzxEvDD4r3DBgXj6FxUKNaXGPhd18AzzCXeX88LcJxWAPd-2Fv7JiB88FpQ5kwb7TyWiLLfMzbetfGykMOctbu8W3BbDsIyadCguknOKT9sBLCEKiPAam3h8kh-2BsXXxkR2EvqCeFfErZ3PwKa1SVHAEbQojZZV7jqlLyJR8KYd7Ob5ZMYMENFHn0kgSi7eB-2FawHwHTrEhLDYX-2BOWrkMOQimBc4NTUUy5DbdiVfhlyh7bL6srP-2ByInzpsE8pygdal5s3pCDu8-2F94-2B1f3C1MQ9-2FkWFJVilN3Xiglg-3D-3DGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                    • 104.18.142.119
                                                                                                                                                                                                                                    ktyihkdfesf.exeGet hashmaliciousVidarBrowse
                                                                                                                                                                                                                                    • 172.64.41.3
                                                                                                                                                                                                                                    pjthjsdjgjrtavv.exeGet hashmaliciousVidarBrowse
                                                                                                                                                                                                                                    • 172.64.41.3
                                                                                                                                                                                                                                    Captcha.htaGet hashmaliciousLummaC, Cobalt Strike, HTMLPhisher, LummaC StealerBrowse
                                                                                                                                                                                                                                    • 172.67.197.170
                                                                                                                                                                                                                                    file.exeGet hashmaliciousLummaC, Amadey, Cryptbot, LummaC StealerBrowse
                                                                                                                                                                                                                                    • 172.67.180.113
                                                                                                                                                                                                                                    8ZVMneG.exeGet hashmaliciousLummaCBrowse
                                                                                                                                                                                                                                    • 104.21.66.86
                                                                                                                                                                                                                                    https://us-east-2.protection.sophos.com/?d=purogosouls.github.io&u=aHR0cHM6Ly9wdXJvZ29zb3Vscy5naXRodWIuaW8vNjRkczZmNHM5ZDRmODlzZDRzZjQ2c2Q0ZjYv&i=NWQ0M2E1N2M3M2U5MzQxMGM1NjBhNmQ1&t=dEtlN04wQWZmZ0hqZlpiZEYwVXZ4NHFvc2NQNGtsUWl4Unlndk5helZOaz0=&h=356f16f6a39049efa5b305c7477e094a&s=AVNPUEhUT0NFTkNSWVBUSVZaHP6eDnex344kFPbGkNGwPXEfGJHtcvdIV0gRc1_JzA%20us-east-2.protection.sophos.comGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                                                    • 104.21.49.70
                                                                                                                                                                                                                                    Laurier Partners Proposal.emlGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                                                    • 1.1.1.1
                                                                                                                                                                                                                                    Dec 2024_12192924_Image.pdfGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                                                    • 104.21.49.70

                                                                                                                                                                                                                                    JA3 Fingerprints

                                                                                                                                                                                                                                    ⊘No context

                                                                                                                                                                                                                                    Dropped Files

                                                                                                                                                                                                                                    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\bin\MSVCP140.dllwp-cent.exeGet hashmaliciousPython BackDoorBrowse
                                                                                                                                                                                                                                      wp-cent.exeGet hashmaliciousPython BackDoorBrowse
                                                                                                                                                                                                                                        WTvNL75dCr.exeGet hashmaliciousPython BackDoorBrowse
                                                                                                                                                                                                                                          WTvNL75dCr.exeGet hashmaliciousPython BackDoorBrowse
                                                                                                                                                                                                                                            FileScanner.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                              MacAttack.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                download.ps1Get hashmaliciousPython BackDoorBrowse
                                                                                                                                                                                                                                                  y3x8pjQ1Ci.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                    y3x8pjQ1Ci.exeGet hashmaliciousUnknownBrowse

                                                                                                                                                                                                                                                      Created / dropped Files

                                                                                                                                                                                                                                                      C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_wp-s2.exe_2b6876b9d34de520d6e735f39948ec398686c89_c328f930_b0376b47-ba39-491c-9596-7ac4d71d83ae\Report.wer

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Windows\System32\WerFault.exe
                                                                                                                                                                                                                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):65536
                                                                                                                                                                                                                                                      Entropy (8bit):1.349222188555734
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:192:uaIsFgF0pgzHjoR7uZ54nuoYv6KjBw9PNU4dLaJ1oTLwnCQML4LgV8gv1SnYzuiR:NBgmpgzHj0vwnVoRzuiFyY4lO8Y
                                                                                                                                                                                                                                                      MD5:7A6B5A1978708A116A670B663A7DD2D0
                                                                                                                                                                                                                                                      SHA1:4DEBE5048C4338B70376799B5B6A3D267E06682D
                                                                                                                                                                                                                                                      SHA-256:63BB11795D18BF14FDA5499BE7C8AF6DFABD544FC8A23AF0D10F36D37CB725B8
                                                                                                                                                                                                                                                      SHA-512:22FC6C6CF89D2C442AED026981B8CDB683D446CE84CF53EEEA9A0AFFD7223EE2486FD9D65C5FA6B67C4985AF46F08C790115B49D8AD878EA8929342868C65406
                                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                                                                                      Preview:..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.6.4.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.9.1.5.8.5.1.7.5.9.7.6.8.8.5.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.9.1.5.8.5.1.8.5.8.2.0.6.7.0.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.b.0.3.7.6.b.4.7.-.b.a.3.9.-.4.9.1.c.-.9.5.9.6.-.7.a.c.4.d.7.1.d.8.3.a.e.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.f.8.e.f.3.7.5.3.-.9.3.f.0.-.4.6.2.8.-.b.1.b.d.-.0.a.9.6.a.7.d.8.4.7.6.c.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.w.p.-.s.2...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.a.6.0.-.0.0.0.1.-.0.0.1.4.-.b.e.8.5.-.6.5.d.e.b.c.5.2.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.4.4.7.4.a.d.6.1.0.0.0.a.e.e.2.d.c.d.d.5.d.b.0.c.b.0.e.5.e.8.a.f.0.0.0.0.f.f.f.f.!.0.0.0.0.8.7.c.e.8.6.a.7.6.9.e.f.3.9.e.f.b.4.d.c.f.c.1.7.6.1.8.7.7.d.8.3.7.c.5.2.f.b.a.c.!.w.p.-.s.2...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.1.2././.1.6.:.1.2.:.3.1.:.5.9.!.2.4.f.

                                                                                                                                                                                                                                                      C:\ProgramData\Microsoft\Windows\WER\Temp\WERD2C0.tmp.dmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Windows\System32\WerFault.exe
                                                                                                                                                                                                                                                      File Type:Mini DuMP crash report, 15 streams, Fri Dec 20 08:55:18 2024, 0x1205a4 type
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):144436
                                                                                                                                                                                                                                                      Entropy (8bit):1.9421565353130301
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:768:bcLTurEZ4GBOVF97394bATvFqdpwfDPz1MA7gvTX30:0Z7yT73m0TIdpwfDPZMA7gvTn0
                                                                                                                                                                                                                                                      MD5:6B9F899158566F33A092C1F5B69F3932
                                                                                                                                                                                                                                                      SHA1:7931429D35AB3AED0ADC3596D911D31BAF21B327
                                                                                                                                                                                                                                                      SHA-256:FF807F9A38753788E0E582DED3B1BF896B1C9BB4E3BCB98155D582545F792302
                                                                                                                                                                                                                                                      SHA-512:21EFF5EE8F719C1DEF29E86A7D90BFF9594898F2F8C682479B63E7AE54359FAC40314DB18F5C39DF7F0480A255616ABA0C8FBE50D7C71DBF363773D576D54616
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                                                                                      Preview:MDMP..a..... ........0eg............T............%..h.......$....-......D....a..........`.......8...........T............%..T........................0..............................................................................eJ.......0......Lw......................T.......`....0eg.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\ProgramData\Microsoft\Windows\WER\Temp\WERD5DE.tmp.WERInternalMetadata.xml

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Windows\System32\WerFault.exe
                                                                                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):9594
                                                                                                                                                                                                                                                      Entropy (8bit):3.7056229869654995
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:192:R6l7wVeJUj5bY6YfN1lXgmf7lpDG89beT1ffKm:R6lXJu5bY6YF1lXgmf7/eBfj
                                                                                                                                                                                                                                                      MD5:C1A67317E75B7C1AE5985B0BF8843354
                                                                                                                                                                                                                                                      SHA1:AB459C5C388CAA19489867579D8DDC45276429AC
                                                                                                                                                                                                                                                      SHA-256:5D4D42F89F005D078B8B23E541D4047A1EAF3945A97FE210DA6993D7E0D0BD1D
                                                                                                                                                                                                                                                      SHA-512:9C3CF92584F3050D8B6900801AC848B53750E76F74DE87C1430FEF351D347F3341A26AEB1C6F3087229A081B8471E58A9061DBFE40CFCC0EF58778D754283E30
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                                                                                      Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.7.5.2.<./.P.i.

                                                                                                                                                                                                                                                      C:\ProgramData\Microsoft\Windows\WER\Temp\WERD60D.tmp.xml

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Windows\System32\WerFault.exe
                                                                                                                                                                                                                                                      File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):4735
                                                                                                                                                                                                                                                      Entropy (8bit):4.429004525698766
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:48:cvIwWl8zs0qJg771I9D4WpW8VYtYm8M4JzWDFwEyq8vVWanGR88zL+d:uIjf7I78x7VFJaqEWUanGR88zL+d
                                                                                                                                                                                                                                                      MD5:BE2F2A3FF5CD0B4BA6C13629FE5DC5F4
                                                                                                                                                                                                                                                      SHA1:FEC1661D3ABDAD2679EC9E32C07E1E5C2E177402
                                                                                                                                                                                                                                                      SHA-256:ADA20F0A7A8D5A2C0B04A078941717488F72D7D82935721B54705E79350EE1E7
                                                                                                                                                                                                                                                      SHA-512:43FA91F6453213B803811C42ED7C28CC9464D3D95F2B3E8E74E1FC129E647BED2B4D950FBC8AFF8BF55C7FA30527EB6FEF50C1F5E869CC07A8FA32E29FF07604
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="639357" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\bin\MSVCP140.dll

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):590112
                                                                                                                                                                                                                                                      Entropy (8bit):6.461874649448891
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:12288:xI88L4Wu4+oJ+xc39ax5Ms4ETs3rxSvYcRkdQEKZm+jWodEEVh51:xD89rxZfQEKZm+jWodEEP5
                                                                                                                                                                                                                                                      MD5:01B946A2EDC5CC166DE018DBB754B69C
                                                                                                                                                                                                                                                      SHA1:DBE09B7B9AB2D1A61EF63395111D2EB9B04F0A46
                                                                                                                                                                                                                                                      SHA-256:88F55D86B50B0A7E55E71AD2D8F7552146BA26E927230DAF2E26AD3A971973C5
                                                                                                                                                                                                                                                      SHA-512:65DC3F32FAF30E62DFDECB72775DF870AF4C3A32A0BF576ED1AAAE4B16AC6897B62B19E01DC2BF46F46FBE3F475C061F79CBE987EDA583FEE1817070779860E5
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                      Joe Sandbox View:
                                                                                                                                                                                                                                                      • Filename: wp-cent.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                      • Filename: wp-cent.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                      • Filename: WTvNL75dCr.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                      • Filename: WTvNL75dCr.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                      • Filename: FileScanner.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                      • Filename: MacAttack.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                      • Filename: download.ps1, Detection: malicious, Browse
                                                                                                                                                                                                                                                      • Filename: y3x8pjQ1Ci.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                      • Filename: y3x8pjQ1Ci.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........LS..-=..-=..-=.....-=..U...-=..-<.k-=.gB<..-=.gB9..-=.gB>..-=.gB8.=-=.gB=..-=.gB..-=.gB?..-=.Rich.-=.........PE..d.....t^.........." .....@..........."...............................................z....`A.........................................j..h....D..,...............L;...... A......(...@...8...............................0............P.......f..@....................text...,>.......@.................. ..`.rdata..r....P.......D..............@..@.data....:...`..."...N..............@....pdata..L;.......<...p..............@..@.didat..h...........................@....rsrc...............................@..@.reloc..(...........................@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\bin\MSVCP140_1.dll

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):31728
                                                                                                                                                                                                                                                      Entropy (8bit):6.499754548353504
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:384:rOY/H1SbuIqnX8ndnWc95gW3C8c+pBj0HRN7bULkcyHRN7rxTO6iuQl9xiv:yYIBqnMdxxWd4urv
                                                                                                                                                                                                                                                      MD5:0FE6D52EB94C848FE258DC0EC9FF4C11
                                                                                                                                                                                                                                                      SHA1:95CC74C64AB80785F3893D61A73B8A958D24DA29
                                                                                                                                                                                                                                                      SHA-256:446C48C1224C289BD3080087FE15D6759416D64F4136ADDF30086ABD5415D83F
                                                                                                                                                                                                                                                      SHA-512:C39A134210E314627B0F2072F4FFC9B2CE060D44D3365D11D8C1FE908B3B9403EBDD6F33E67D556BD052338D0ED3D5F16B54D628E8290FD3A155F55D36019A86
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......>.{.zl..zl..zl......xl..s...~l.....}l.....xl..zl..Ql......l.....il.....{l.....{l.....{l..Richzl..................PE..d.....t^.........." .........$......p.....................................................`A........................................p>..L....?..x....p.......`..X....:...A......p...P3..8............................3..0............0..@............................text............................... ..`.rdata.......0......................@..@.data........P.......,..............@....pdata..X....`.......0..............@..@.rsrc........p.......4..............@..@.reloc..p............8..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\bin\Qt5Core.dll

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):6023664
                                                                                                                                                                                                                                                      Entropy (8bit):6.768988071491288
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:98304:hcirJylHYab/6bMJsv6tWKFdu9CLiZxqfg8gwf:+irJylHFb/QMJsv6tWKFdu9CL4xqfg8x
                                                                                                                                                                                                                                                      MD5:817520432A42EFA345B2D97F5C24510E
                                                                                                                                                                                                                                                      SHA1:FEA7B9C61569D7E76AF5EFFD726B7FF6147961E5
                                                                                                                                                                                                                                                      SHA-256:8D2FF4CE9096DDCCC4F4CD62C2E41FC854CFD1B0D6E8D296645A7F5FD4AE565A
                                                                                                                                                                                                                                                      SHA-512:8673B26EC5421FCE8E23ADF720DE5690673BB4CE6116CB44EBCC61BBBEF12C0AD286DFD675EDBED5D8D000EFD7609C81AAE4533180CF4EC9CD5316E7028F7441
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                      Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......D.............................UJ......................................................W.....,..................r....................Rich............PE..d...;._.........." ..........-.......-......................................`\.....x.\...`...........................................L..O....T...... \.......U.. ....[......0\..%..,.H.T.....................H.(.....H.0............./.H............................text............................... ..`.rdata..F7%.../..8%.................@..@.data...x....PT..\...6T.............@....pdata... ....U.."....T.............@..@.qtmimed.....0W.......V.............@..P.rsrc........ \.......[.............@..@.reloc...%...0\..&....[.............@..B........................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\bin\Qt5DBus.dll

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):436720
                                                                                                                                                                                                                                                      Entropy (8bit):6.392610185061176
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:6144:ZLvnUJ17UTGOkWHUe/W9TgYMDu96ixMZQ8IlXbKgp8aIDeN:KP7cGOGegTwu96ixMZQtlrPN
                                                                                                                                                                                                                                                      MD5:0E8FF02D971B61B5D2DD1AC4DF01AE4A
                                                                                                                                                                                                                                                      SHA1:638F0B46730884FA036900649F69F3021557E2FE
                                                                                                                                                                                                                                                      SHA-256:1AA70B106A10C86946E23CAA9FC752DC16E29FBE803BBA1F1AB30D1C63EE852A
                                                                                                                                                                                                                                                      SHA-512:7BA616EDE66B16D9F8B2A56C3117DB49A74D59D0D32EAA6958DE57EAC78F14B1C7F2DBBA9EAE4D77937399CF14D44535531BAF6F9DB16F357F8712DFAAE4346A
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........D..*..*..*.....*...+..*.../..*.......*...)..*...+..*.O.+..*..+...*.O./..*.O.*..*.O....*.....*.O.(..*.Rich.*.........................PE..d...]._.........." .....\...<.......\..............................................K.....`..........................................h..to...................`...Q..............4.......T.......................(...`...0............p...............................text...yZ.......\.................. ..`.rdata..0....p.......`..............@..@.data...X....@......."..............@....pdata...Q...`...R...2..............@..@.rsrc...............................@..@.reloc..4...........................@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\bin\Qt5Gui.dll

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):7008240
                                                                                                                                                                                                                                                      Entropy (8bit):6.674290383197779
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:49152:9VPhJZWVvpg+za3cFlc61j2VjBW77I4iNlmLPycNRncuUx24LLsXZFC6FOCfDt2/:BJZzI1ZR3U9Cxc22aDACInVc4Z
                                                                                                                                                                                                                                                      MD5:47307A1E2E9987AB422F09771D590FF1
                                                                                                                                                                                                                                                      SHA1:0DFC3A947E56C749A75F921F4A850A3DCBF04248
                                                                                                                                                                                                                                                      SHA-256:5E7D2D41B8B92A880E83B8CC0CA173F5DA61218604186196787EE1600956BE1E
                                                                                                                                                                                                                                                      SHA-512:21B1C133334C7CA7BBBE4F00A689C580FF80005749DA1AA453CCEB293F1AD99F459CA954F54E93B249D406AEA038AD3D44D667899B73014F884AFDBD9C461C14
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                      Preview:MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.......QH^~.)0-.)0-.)0-.Q.-.)0-...-.)0-.F4,.)0-.F3,.)0-.F5,.)0-.F1,.)0-.Y1,.)0-.B5,.)0-.B1,.)0-.)1-m,0-.Y4,.)0-.Y5,|(0-.Y0,.)0-.Y.-.)0-.).-.)0-.Y2,.)0-Rich.)0-................PE..d....._.........." ......?...+.....X.?.......................................k.....R.k...`.........................................pKK.....d.e.|....`k.......g.......j......pk..6....F.T................... .F.(.....F.0.............?.p+...........................text...2.?.......?................. ..`.rdata...z&...?..|&...?.............@..@.data....o... f.......f.............@....pdata........g.......f.............@..@.rsrc........`k.......j.............@..@.reloc...6...pk..8....j.............@..B........................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\bin\Qt5Network.dll

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):1340400
                                                                                                                                                                                                                                                      Entropy (8bit):6.41486755163134
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:24576:eXPn73RXox1U9M0m+1ffSDY565RzHUY1iaRy95hdGehEM:+7hXU1U95m4ff9A5RviaRy9NGI
                                                                                                                                                                                                                                                      MD5:3569693D5BAE82854DE1D88F86C33184
                                                                                                                                                                                                                                                      SHA1:1A6084ACFD2AA4D32CEDFB7D9023F60EB14E1771
                                                                                                                                                                                                                                                      SHA-256:4EF341AE9302E793878020F0740B09B0F31CB380408A697F75C69FDBD20FC7A1
                                                                                                                                                                                                                                                      SHA-512:E5EFF4A79E1BDAE28A6CA0DA116245A9919023560750FC4A087CDCD0AB969C2F0EEEC63BBEC2CD5222D6824A01DD27D2A8E6684A48202EA733F9BB2FAB048B32
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                      Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.........Yt..7'..7'..7'...'..7'..3&..7'}.3&..7'}.4&..7'}.2&..7'}.6&..7'..6&..7'0.6&..7'..6'c.7'0.2&2.7'0.7&..7'0..'..7'...'..7'0.5&..7'Rich..7'........................PE..d....._.........." .................................................................c....`......................................... ....n..,...h....................X..........,.......T...................p...(...@...0............................................text...C........................... ..`.rdata...g.......h..................@..@.data...XN...@...2... ..............@....pdata...............R..............@..@.rsrc................>..............@..@.reloc..,............D..............@..B................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\bin\Qt5Qml.dll

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):3591664
                                                                                                                                                                                                                                                      Entropy (8bit):6.333693598000157
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:98304:iPnt09+kVh2NrSdSG779LLLS/o/L4YqoY0Xba+mRRH2T:iPnt2ZVhT
                                                                                                                                                                                                                                                      MD5:D055566B5168D7B1D4E307C41CE47C4B
                                                                                                                                                                                                                                                      SHA1:043C0056E9951DA79EC94A66A784972532DC18EF
                                                                                                                                                                                                                                                      SHA-256:30035484C81590976627F8FACE9507CAA8581A7DC7630CCCF6A8D6DE65CAB707
                                                                                                                                                                                                                                                      SHA-512:4F12D17AA8A3008CAA3DDD0E41D3ED713A24F9B5A465EE93B2E4BECCF876D5BDF0259AA0D2DD77AD61BB59DC871F78937FFBE4D0F60638014E8EA8A27CAF228D
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......W.4...Z...Z...Z......Z..^...Z..Y...Z.._...Z..[...Z...[...Z...[...Z...[...Z..._...Z...Z...Z.......Z......Z...X...Z.Rich..Z.........PE..d......_.........." .....^$..........O$.......................................7.....}.7...`...........................................,......2.......6.......4. .....6.......6..J....).T.....................).(...p.).0............p$..%...........................text....\$......^$................. ..`.rdata......p$......b$.............@..@.data.........3..n....2.............@....pdata.. .....4......l4.............@..@.rsrc.........6......`6.............@..@.reloc...J....6..L...f6.............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\bin\Qt5QmlModels.dll

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):438768
                                                                                                                                                                                                                                                      Entropy (8bit):6.312090336793804
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:6144:k1tE6lq982HdyuEZ5gw+VHDZjZ0yOWm7Vdcm4GyasLCZCu6vdQp:k1tEuq9Hdyuo5gwguyOtVIup
                                                                                                                                                                                                                                                      MD5:2030C4177B499E6118BE5B9E5761FCE1
                                                                                                                                                                                                                                                      SHA1:050D0E67C4AA890C80F46CF615431004F2F4F8FC
                                                                                                                                                                                                                                                      SHA-256:51E4E5A5E91F78774C44F69B599FAE4735277EF2918F7061778615CB5C4F6E81
                                                                                                                                                                                                                                                      SHA-512:488F7D5D9D8DEEE9BBB9D63DAE346E46EFEB62456279F388B323777999B597C2D5AEA0EE379BDF94C9CBCFD3367D344FB6B5E90AC40BE2CE95EFA5BBDD363BCC
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......x..<...<...<...5.H.4...(...>.......*.......4.......8.......8......9...<...g....../......=....$.=...<.L.=......=...Rich<...................PE..d...M.._.........." .....(...r......d+..............................................MF....`.........................................0E...^..0................`.. F..................H...T.......................(.......0............@...............................text...N&.......(.................. ..`.rdata.......@.......,..............@..@.data...x/...0...(..................@....pdata.. F...`...H...>..............@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\bin\Qt5Quick.dll

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):4148720
                                                                                                                                                                                                                                                      Entropy (8bit):6.462183686222023
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:49152:EcDwCQsvkBD+ClI3IAVLA7Tr15SokomoqxQhT2bAssCFEUGX5ig:E7CKPsA3p0Z/QV/sS3Ag
                                                                                                                                                                                                                                                      MD5:65F59CFC0C1C060CE20D3B9CEFFBAF46
                                                                                                                                                                                                                                                      SHA1:CFD56D77506CD8C0671CA559D659DAB39E4AD3C2
                                                                                                                                                                                                                                                      SHA-256:C81AD3C1111544064B1830C6F1AEF3C1FD13B401546AB3B852D697C0F4D854B3
                                                                                                                                                                                                                                                      SHA-512:D6F6DC19F1A0495026CBA765B5A2414B6AF0DBFC37B5ACEED1CD0AE37B3B0F574B759A176D75B01EDD74C6CE9A3642D3D29A3FD7F166B53A41C8978F562B4B50
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......!Fvge'.4e'.4e'.4l_.4i'.4.H.5m'.4.H.5a'.4.H.5|'.4.H.5c'.4.W.5o'.4qL.5`'.4e'.4.,.4.W.5.'.4.W.5d'.4.W.4d'.4e'.4d'.4.W.5d'.4Riche'.4........................PE..d......_.........." ......%..B......L.$.......................................?.......?...`.........................................0)2.P.....8.T.....>.......<..^...2?.......?.py......T.......................(.......0............ %..\...........................text.....%.......%................. ..`.rdata....... %.......%.............@..@.data....I...@;..2... ;.............@....pdata...^....<..`...R<.............@..@.rsrc.........>.......>.............@..@.reloc..py....?..z....>.............@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\bin\Qt5Svg.dll

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):330736
                                                                                                                                                                                                                                                      Entropy (8bit):6.381828869454302
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:6144:6qLZcTC3wR/0JNZ+csBkBv0L0hq+SvcO8MsvwbIeblsjTR:6qNcCwqHE2fYlsPR
                                                                                                                                                                                                                                                      MD5:03761F923E52A7269A6E3A7452F6BE93
                                                                                                                                                                                                                                                      SHA1:2CE53C424336BCC8047E10FA79CE9BCE14059C50
                                                                                                                                                                                                                                                      SHA-256:7348CFC6444438B8845FB3F59381227325D40CA2187D463E82FC7B8E93E38DB5
                                                                                                                                                                                                                                                      SHA-512:DE0FF8EBFFC62AF279E239722E6EEDD0B46BC213E21D0A687572BFB92AE1A1E4219322233224CA8B7211FFEF52D26CB9FE171D175D2390E3B3E6710BBDA010CB
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............_._._..*_._,.^._..^._,.^._,.^._,.^._a.^._._=.._a.^._a.^._a.F_._.._._a.^._Rich._................PE..d......_.........." .........................................................@.......^....`.................................................((....... ...........0...........0..H...xL..T....................N..(....L..0............................................text............................... ..`.rdata..p...........................@..@.data...8...........................@....pdata...0.......2..................@..@.rsrc........ ......................@..@.reloc..H....0......................@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\bin\Qt5WebSockets.dll

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):149488
                                                                                                                                                                                                                                                      Entropy (8bit):6.116105454277536
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:3072:4sSkET6pEXb3loojg1Q2sorWvZXF2sorrLA7cG27Qhvvc:4sSd6pwzloDbsnX0sCrc7ct7QVc
                                                                                                                                                                                                                                                      MD5:A016545F963548E0F37885E07EF945C7
                                                                                                                                                                                                                                                      SHA1:CBE499E53AB0BD2DA21018F4E2092E33560C846F
                                                                                                                                                                                                                                                      SHA-256:6B56F77DA6F17880A42D2F9D2EC8B426248F7AB2196A0F55D37ADE39E3878BC6
                                                                                                                                                                                                                                                      SHA-512:47A3C965593B97392F8995C7B80394E5368D735D4C77F610AFD61367FFE7658A0E83A0DBD19962C4FA864D94F245A9185A915010AFA23467F999C833982654C2
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........'`.CF.KCF.KCF.KJ>.KGF.K.).JAF.KW-.JAF.K.).JVF.K.).JKF.K.).J@F.K.6.JFF.KCF.K.G.K.6.JPF.K.6.JBF.K.6.KBF.KCF.KBF.K.6.JBF.KRichCF.K........................PE..d......_.........." .....$..........t(.......................................p.......5....`............................................."..l........P.......0.......,.......`..L...hw..T....................x..(....w..0............@...............................text....".......$.................. ..`.rdata..z....@.......(..............@..@.data...x...........................@....pdata.......0......................@..@.rsrc........P......."..............@..@.reloc..L....`.......(..............@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\bin\Qt5Widgets.dll

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):5498352
                                                                                                                                                                                                                                                      Entropy (8bit):6.619117060971844
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:49152:KO+LIFYAPZtMym9RRQ7/KKIXSewIa/2Xqq1sfeOoKGOh6EwNmiHYYwBrK8KMlH0p:IGoKZdRqJD10rK8KMlH0gi5GX0oKZ
                                                                                                                                                                                                                                                      MD5:4CD1F8FDCD617932DB131C3688845EA8
                                                                                                                                                                                                                                                      SHA1:B090ED884B07D2D98747141AEFD25590B8B254F9
                                                                                                                                                                                                                                                      SHA-256:3788C669D4B645E5A576DE9FC77FCA776BF516D43C89143DC2CA28291BA14358
                                                                                                                                                                                                                                                      SHA-512:7D47D2661BF8FAC937F0D168036652B7CFE0D749B571D9773A5446C512C58EE6BB081FEC817181A90F4543EBC2367C7F8881FF7F80908AA48A7F6BB261F1D199
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........x..................I.......I.......I.......I...........................................9.................................Rich............PE..d....._.........." ......3..P .......3.......................................T......MT...`.........................................0.D.P^....L.h....pS......0P..8....S.......S.d.....?.T...................`.?.(...0.?.0.............3.._...........................text.....3.......3................. ..`.rdata..8.....3.......3.............@..@.data.........O......dO.............@....pdata...8...0P..:....O.............@..@.rsrc........pS......4S.............@..@.reloc..d.....S......:S.............@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\bin\VCRUNTIME140.dll

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):101872
                                                                                                                                                                                                                                                      Entropy (8bit):6.5661918084228725
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:1536:RCKWZGuEK0mOLSTxoPl9GIcuZrxi4hXX9oix8H+NCIecbGShwZul:RFWY1WxgGStJ8H2CIecbG36
                                                                                                                                                                                                                                                      MD5:971DBBE854FC6AB78C095607DFAD7B5C
                                                                                                                                                                                                                                                      SHA1:1731FB947CD85F9017A95FDA1DC5E3B0F6B42CA2
                                                                                                                                                                                                                                                      SHA-256:5E197A086B6A7711BAA09AFE4EA7C68F0E777B2FF33F1DF25A21F375B7D9693A
                                                                                                                                                                                                                                                      SHA-512:B966AAB9C0D9459FADA3E5E96998292D6874A7078924EA2C171F0A1A50B0784C24CC408D00852BEC48D6A01E67E41D017684631176D3E90151EC692161F1814D
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........w.............t:..............................................................Rich....................PE..d.....t^.........." .........^.......................................................e....`A.........................................0..4....9.......p.......P.......L...A..............8........................... ...0............................................text...2........................... ..`.rdata...?.......@..................@..@.data...0....@.......4..............@....pdata.......P.......8..............@..@_RDATA.......`.......D..............@..@.rsrc........p.......F..............@..@.reloc...............J..............@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\bin\VCRUNTIME140_1.dll

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):44528
                                                                                                                                                                                                                                                      Entropy (8bit):6.627837381503075
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:384:Aim/NRETi8kykt25HwviU5fJUiP2551xWmbTqOA7SXf+Ny85xM8ATJWr3KWoC8cS:0Ie8kySL2iPQxdvjAevcMESW5lxJG
                                                                                                                                                                                                                                                      MD5:6BC084255A5E9EB8DF2BCD75B4CD0777
                                                                                                                                                                                                                                                      SHA1:CF071AD4E512CD934028F005CABE06384A3954B6
                                                                                                                                                                                                                                                      SHA-256:1F0F5F2CE671E0F68CF96176721DF0E5E6F527C8CA9CFA98AA875B5A3816D460
                                                                                                                                                                                                                                                      SHA-512:B822538494D13BDA947655AF791FED4DAA811F20C4B63A45246C8F3BEFA3EC37FF1AA79246C89174FE35D76FFB636FA228AFA4BDA0BD6D2C41D01228B151FD89
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........ .S.A...A...A..0.m..A..O....A...9...A...A...A..O....A..O....A..O....A..O....A..O.}..A..O....A..Rich.A..................PE..d.....t^.........." .....:...4......pA...............................................Z....`A.........................................j......|k..x....................l...A......8....b..8...........................@b..0............P..X............................text....9.......:.................. ..`.rdata... ...P..."...>..............@..@.data................`..............@....pdata...............b..............@..@.rsrc................f..............@..@.reloc..8............j..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\bin\d3dcompiler_47.dll

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):4173928
                                                                                                                                                                                                                                                      Entropy (8bit):6.329102290474506
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:49152:8BfmqCtLI4erBYysLjG/A8McPyCD6hw16JVTW7B3EgvVlQ3LAYmyNOvGJse+aWyb:8eZevVKACOvWYQF
                                                                                                                                                                                                                                                      MD5:B0AE3AA9DD1EBD60BDF51CB94834CD04
                                                                                                                                                                                                                                                      SHA1:EE2F5726AC140FB42D17ABA033D678AFAF8C39C1
                                                                                                                                                                                                                                                      SHA-256:E994847E01A6F1E4CBDC5A864616AC262F67EE4F14DB194984661A8D927AB7F4
                                                                                                                                                                                                                                                      SHA-512:756EBF4FA49029D4343D1BDB86EA71B2D49E20ADA6370FD7582515455635C73D37AD0DBDEEF456A10AB353A12412BA827CA4D70080743C86C3B42FA0A3152AA3
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 3%
                                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......G..(.a.{.a.{.a.{..m{5a.{..l{.a.{.m{.a.{.o{.a.{.a.{.a.{.i{.a.{.l{.a.{.h{.a.{.q{.a.{.k{.a.{.n{.a.{Rich.a.{........................PE..d......R.........." ......;.........`.8......................................@@......a@...`...........................................;.u...P.>.d.....?.@.....=......t?.h<... ?..{..................................@a................>.P............................text.....;.......;................. ..`.data...h.....;.......;.............@....pdata........=......n<.............@..@.idata..@.....>......B>.............@..@.rsrc...@.....?......\>.............@..@.reloc....... ?......b>.............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\bin\libEGL.dll

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):25072
                                                                                                                                                                                                                                                      Entropy (8bit):5.961464514165753
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:384:KEyYvsyDQrjwgut4Maw+XZndDGg7Dgf2hU:RvszjwgocwOhdDGEUf2hU
                                                                                                                                                                                                                                                      MD5:BB00EF1DD81296AF10FDFA673B4D1397
                                                                                                                                                                                                                                                      SHA1:773FFCF4A231B963BAAC36CBEF68079C09B62837
                                                                                                                                                                                                                                                      SHA-256:32092DE077FD57B6EF355705EC46C6D21F6D72FBE3D3A5DD628F2A29185A96FA
                                                                                                                                                                                                                                                      SHA-512:C87C0868C04852B63A7399AFE4E568CD9A65B7B7D5FD63030ABEA649AAC5E9F2293AB5BE2B2CE56A57F2B4B1992AE730150A293ADA53637FC5CD7BE0A727CBD4
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........9...Xv@.Xv@.Xv@. .@.Xv@.7wA.Xv@.3wA.Xv@.7sA.Xv@.7rA.Xv@.7uA.Xv@W(wA.Xv@.Xw@.Xv@W(sA.Xv@W(vA.Xv@W(.@.Xv@.X.@.Xv@W(tA.Xv@Rich.Xv@........PE..d...#._.........." .........0......................................................Z.....`.........................................`9.......B..d.......H....p.......F.......... ....3..T............................4..0............0...............................text............................... ..`.rdata..r#...0...$..................@..@.data........`.......:..............@....pdata.......p.......<..............@..@.rsrc...H............>..............@..@.reloc.. ............D..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\bin\libGLESv2.dll

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):3385328
                                                                                                                                                                                                                                                      Entropy (8bit):6.382356347494905
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:49152:sU0O89Onk/cNTgO/WSLqfTPnK+9eaOiY95ZEQryD1pPG3L:MaHUKt3L
                                                                                                                                                                                                                                                      MD5:2247EE4356666335DF7D72129AF8D600
                                                                                                                                                                                                                                                      SHA1:F0131C1A67FC17C0E8DCC4A4CA38C9F1780E7182
                                                                                                                                                                                                                                                      SHA-256:50FAD5605B3D57627848B3B84A744DFB6A045609B8236B04124F2234676758D8
                                                                                                                                                                                                                                                      SHA-512:67F2A7BF169C7B9A516689CF1B16446CA50E57F099B9B742CCB1ABB2DCDE8867F8F6305AD8842CD96194687FC314715AE04C1942B0E0A4F51B592B028C5B16D3
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............t..t..t....t.A.p..t.A.w..t.A.q..t.A.u..t.u..t..u..t...q..t...t..t......t.....t...v..t.Rich..t.........PE..d....._.........." ......&.........L.&.......................................3.......3...`..........................................0..]....0.......3.P.....1.L.....3.......3..;...},.T...................P.,.(... ~,.0.............'..............................text...o.&.......&................. ..`.rdata........'.......&.............@..@.data.........1.......0.............@....pdata..L.....1.......1.............@..@.rsrc...P.....3......J3.............@..@.reloc...;....3..<...P3.............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\bin\opengl32sw.dll

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):20923392
                                                                                                                                                                                                                                                      Entropy (8bit):6.255903817217008
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:393216:LIckHor5uLnn83wAP5hxOZEa7/LzRuDFqILn5LgcKyZyQXt+8M:yEZbv
                                                                                                                                                                                                                                                      MD5:7DBC97BFEE0C7AC89DA8D0C770C977B6
                                                                                                                                                                                                                                                      SHA1:A064C8D8967AAA4ADA29BD9FEFBE40405360412C
                                                                                                                                                                                                                                                      SHA-256:963641A718F9CAE2705D5299EAE9B7444E84E72AB3BEF96A691510DD05FA1DA4
                                                                                                                                                                                                                                                      SHA-512:286997501E1F5CE236C041DCB1A225B4E01C0F7C523C18E9835507A15C0AC53C4D50F74F94822125A7851FE2CB2FB72F84311A2259A5A50DCE6F56BA05D1D7E8
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......[.@..............'.......'.......'..[...........|.-.....|.+.*...|.*.<....'......../.....q.*.....q.+....q.&.^...q.......q.,.....Rich............PE..d....._W.........." .....(....b.....|&....................................... E...........`.........................................0.1.t.....1...............9.`n............C..k.. . .T..................... .(..... ..............@...............................text...T&.......(.................. ..`.rdata..XvO..@...xO..,..............@..@.data....;....1.......1.............@....pdata..`n....9..p...D3.............@..@.gfids.......pC.......=.............@..@.tls..........C.......=.............@..._RDATA........C.......=.............@..@.reloc...k....C..l....=.............@..B................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\plugins\generic\qtuiotouchplugin.dll

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):68080
                                                                                                                                                                                                                                                      Entropy (8bit):6.207162014262433
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:1536:mQ4IT53ign4CbtlO705xWL3frA5rlhgQJ7tapgUff:mLIT53Hbtk70OLs3hg0Cz
                                                                                                                                                                                                                                                      MD5:750A31DE7840B5EED8BA14C1BD84D348
                                                                                                                                                                                                                                                      SHA1:D345D13B0C303B7094D1C438E49F0046791DE7F6
                                                                                                                                                                                                                                                      SHA-256:A9BFFB0F3CD69CD775C328C916E46440FE80D99119FAEBC350C7EC51E3E57C41
                                                                                                                                                                                                                                                      SHA-512:5C0A68ED27A9F1BBFF104942152E475C94BB64B03CE252EAAC1A6770E24DC4156CE4ADE99EBCD92662801262DED892C33F84C605AD84472B45A83C4883D5E767
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............h..h..h...s.h..]...h.....h..]...h..]...h..]...h......h..h..&h......h......h......h......h..Rich.h..................PE..d...X._.........." .........b......$........................................@......{v....`......................................... ................ ..X....................0......H...T......................(.......0............................................text............................... ..`.rdata...E.......F..................@..@.data...............................@....pdata..............................@..@.qtmetadi...........................@..P.rsrc...X.... ......................@..@.reloc.......0......................@..B................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\plugins\iconengines\qsvgicon.dll

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):41968
                                                                                                                                                                                                                                                      Entropy (8bit):6.0993566622860635
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:768:VPs5g31JfDgej5JZmA0ZsEEC6lmn+4FdDGimUf2hr:VkC31ee7ZmA+sEEC6lmn+4FOUfc
                                                                                                                                                                                                                                                      MD5:313F89994F3FEA8F67A48EE13359F4BA
                                                                                                                                                                                                                                                      SHA1:8C7D4509A0CAA1164CC9415F44735B885A2F3270
                                                                                                                                                                                                                                                      SHA-256:42DDE60BEFCF1D9F96B8366A9988626B97D7D0D829EBEA32F756D6ECD9EA99A8
                                                                                                                                                                                                                                                      SHA-512:06E5026F5DB929F242104A503F0D501A9C1DC92973DD0E91D2DAF5B277D190082DE8D37ACE7EDF643C70AA98BB3D670DEFE04CE89B483DA4F34E629F8ED5FECF
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......n.:*..i*..i*..i#.Ei...i...h(..i>..h(..i...h8..i...h-..i...h(..i...h-..i*..i...i...h(..i...h+..i..)i+..i...h+..iRich*..i........................PE..d......_.........." .....@...F.......F..............................................C.....`..........................................g..x...hh..........H...........................xX..T....................Z..(....X..0............P...............................text....>.......@.................. ..`.rdata...3...P...4...D..............@..@.data................x..............@....pdata...............z..............@..@.qtmetadj...........................@..P.rsrc...H...........................@..@.reloc..............................@..B........................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\plugins\imageformats\qgif.dll

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):39408
                                                                                                                                                                                                                                                      Entropy (8bit):6.0316011626259405
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:768:ygk2hM0GskFtvPCjEIxh8eDzFyPddeeGvnhotdDGPUf2he:yN2a05kfPOEMaeDzFkddeFnhotOUfh
                                                                                                                                                                                                                                                      MD5:52FD90E34FE8DED8E197B532BD622EF7
                                                                                                                                                                                                                                                      SHA1:834E280E00BAE48A9E509A7DC909BEA3169BDCE2
                                                                                                                                                                                                                                                      SHA-256:36174DD4C5F37C5F065C7A26E0AC65C4C3A41FDC0416882AF856A23A5D03BB9D
                                                                                                                                                                                                                                                      SHA-512:EF3FB3770808B3690C11A18316B0C1C56C80198C1B1910E8AA198DF8281BA4E13DC9A6179BB93A379AD849304F6BB934F23E6BBD3D258B274CC31856DE0FC12B
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........R...3..3..3..KA.3..o\..3..X..3..o\..3..o\..3..o\..3.."C..3..3...3.."C..3.."C..3.."C-.3.."C..3..Rich.3..........PE..d...H._.........." .....@...B.......E...............................................^....`..........................................f..t....f..........@............~..............HW..T....................X..(....W..0............P...............................text...k?.......@.................. ..`.rdata..&)...P...*...D..............@..@.data...(............n..............@....pdata...............p..............@..@.qtmetads............v..............@..P.rsrc...@............x..............@..@.reloc...............|..............@..B........................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\plugins\imageformats\qicns.dll

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):45040
                                                                                                                                                                                                                                                      Entropy (8bit):6.016125225197622
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:768:vEip0IlhxTDxut3dnm8IyAmQQ3ydJouEAkNypTAO0tfC3apmsdDG9Uf2hU:vxvXxgVIyA23ydJlEATpTAO0tfCKpms/
                                                                                                                                                                                                                                                      MD5:AD84AF4D585643FF94BFA6DE672B3284
                                                                                                                                                                                                                                                      SHA1:5D2DF51028FBEB7F6B52C02ADD702BC3FA781E08
                                                                                                                                                                                                                                                      SHA-256:F4A229A082D16F80016F366156A2B951550F1E9DF6D4177323BBEDD92A429909
                                                                                                                                                                                                                                                      SHA-512:B68D83A4A1928EB3390DEB9340CB27B8A3EB221C2E0BE86211EF318B4DD34B37531CA347C73CCE79A640C5B06FBD325E10F8C37E0CEE2581F22ABFBFF5CC0D55
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..................a....Q........Q......Q......Q......................................Rich...........PE..d......_.........." .....B...N.......G...............................................&....`.............................................t...$...........@...........................xp..T....................r..(....p..0............`...............................text....@.......B.................. ..`.rdata...9...`...:...F..............@..@.data...............................@....pdata..............................@..@.qtmetadx...........................@..P.rsrc...@...........................@..@.reloc..............................@..B........................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\plugins\imageformats\qico.dll

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):38384
                                                                                                                                                                                                                                                      Entropy (8bit):5.957072398645384
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:768:zBXBEfQiAzC9Oh5AS7a3Z5OGrTDeV9mp7nnsWdDGgYUf2hi/:8JAzuOhy3zOGrTDeV9mp7nnsWjYUfz
                                                                                                                                                                                                                                                      MD5:A9ABD4329CA364D4F430EDDCB471BE59
                                                                                                                                                                                                                                                      SHA1:C00A629419509929507A05AEBB706562C837E337
                                                                                                                                                                                                                                                      SHA-256:1982A635DB9652304131C9C6FF9A693E70241600D2EF22B354962AA37997DE0B
                                                                                                                                                                                                                                                      SHA-512:004EA8AE07C1A18B0B461A069409E4061D90401C8555DD23DBF164A08E96732F7126305134BFAF8B65B0406315F218E05B5F0F00BEDB840FB993D648CE996756
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........u.G...G...G...N...C......E...S...E......R......O......D.......B...G...........D.......F.......F.......F...RichG...................PE..d...H._.........." .....4...H.......9....................................................`..........................................h..t...th..........@............z..............(X..T....................Y..(....X..0............P..8............................text....2.......4.................. ..`.rdata..B/...P...0...8..............@..@.data...h............h..............@....pdata...............l..............@..@.qtmetad.............r..............@..P.rsrc...@............t..............@..@.reloc...............x..............@..B................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\plugins\imageformats\qjpeg.dll

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):421360
                                                                                                                                                                                                                                                      Entropy (8bit):5.7491063936821405
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:6144:USgOWz1eW38u9tyh6fpGUasBKTrsXWwMmH1l3JM5hn0uEfB4:USPQTnastBRB4
                                                                                                                                                                                                                                                      MD5:16ABCCEB70BA20E73858E8F1912C05CD
                                                                                                                                                                                                                                                      SHA1:4B3A32B166AB5BBBEE229790FDAE9CBC84F936BA
                                                                                                                                                                                                                                                      SHA-256:FB4E980CB5FAFA8A4CD4239329AED93F7C32ED939C94B61FB2DF657F3C6AD158
                                                                                                                                                                                                                                                      SHA-512:3E5C83967BF31C9B7F1720059DD51AA4338E518B076B0461541C781B076135E9CB9CBCEB13A8EC9217104517FBCC356BDD3FFACA7956D1C939E43988151F6273
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Iv"...L...L...L..o....L..xM...L..|M...L.......L..xI...L..xH...L..xO...L..gM...L...M...L..gH.?.L..gI...L..gL...L..g....L..gN...L.Rich..L.........PE..d...o._.........." .....b...........i...............................................g....`.............................................t...............@....`.......R..............h...T.......................(.......0...............@............................text....`.......b.................. ..`.rdata..J............f..............@..@.data...8....P.......(..............@....pdata.......`... ...*..............@..@.qtmetad.............J..............@..P.rsrc...@............L..............@..@.reloc...............P..............@..B........................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\plugins\imageformats\qsvg.dll

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):32240
                                                                                                                                                                                                                                                      Entropy (8bit):5.978149408776758
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:768:uOVKDlJJVlTuLiMtsKVG7TSdDG9Uf2h4e:hVgJVlTuL/tsKVG7TSQUfre
                                                                                                                                                                                                                                                      MD5:C0DE135782FA0235A0EA8E97898EAF2A
                                                                                                                                                                                                                                                      SHA1:FCF5FD99239BF4E0B17B128B0EBEC144C7A17DE2
                                                                                                                                                                                                                                                      SHA-256:B3498F0A10AC4CB42CF7213DB4944A34594FF36C78C50A0F249C9085D1B1FF39
                                                                                                                                                                                                                                                      SHA-512:7BD5F90CCAB3CF50C55EAF14F7EF21E05D3C893FA7AC9846C6CA98D6E6D177263AC5EB8A85A34501BCFCA0DA7F0B6C39769726F4090FCA2231EE64869B81CF0B
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........x>...P...P...P..a...P.&vQ...P..rQ...P.&vU...P.&vT...P.&vS...P.kiQ...P...Q.n.P.kiU...P.kiP...P.ki....P.kiR...P.Rich..P.........PE..d......_.........." .....$...B......D)....................................................`.........................................PU..t....U..........@............b...............G..T....................I..(...PH..0............@..(............................text....".......$.................. ..`.rdata...+...@...,...(..............@..@.data...8....p.......T..............@....pdata...............V..............@..@.qtmetad.............Z..............@..P.rsrc...@............\..............@..@.reloc...............`..............@..B........................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\plugins\imageformats\qtga.dll

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):31728
                                                                                                                                                                                                                                                      Entropy (8bit):5.865766652452823
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:768:1lGALluUEAQATWQ79Z2Y8Ar+dDG2vUf2hF:TZl/EH8WQ794Y8Ar+hvUfm
                                                                                                                                                                                                                                                      MD5:A913276FA25D2E6FD999940454C23093
                                                                                                                                                                                                                                                      SHA1:785B7BC7110218EC0E659C0E5ACE9520AA451615
                                                                                                                                                                                                                                                      SHA-256:5B641DEC81AEC1CF7AC0CCE9FC067BB642FBD32DA138A36E3BDAC3BB5B36C37A
                                                                                                                                                                                                                                                      SHA-512:CEBE48E6E6C5CDF8FC339560751813B8DE11D2471A3DAB7D648DF5B313D85735889D4E704E8EEC0AD1084AB43BE0EBDFBACD038AEAC46D7A951EFB3A7CE838EB
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........F ._'N._'N._'N.V_.Y'N..HO.]'N.KLO.]'N..HK.M'N..HJ.W'N..HM.\'N..WO.Z'N._'O.4'N..WK.\'N..WN.^'N..W..^'N..WL.^'N.Rich_'N.........................PE..d......_.........." ....."...@.......'..............................................7.....`..........................................W..t...dX..........@.......`....`..............(I..T....................J..(....I..0............@..h............................text...[!.......".................. ..`.rdata...)...@...*...&..............@..@.data........p.......P..............@....pdata..`............T..............@..@.qtmetadu............X..............@..P.rsrc...@............Z..............@..@.reloc...............^..............@..B........................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\plugins\imageformats\qtiff.dll

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):390128
                                                                                                                                                                                                                                                      Entropy (8bit):5.724665470266677
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:6144:V0jqHiFBaRe0GPAKwP15e7xrEEEEEEN024Rx/3tkYiHUASQbs/l7OanYoOgyV:0qqwP15bx/q7/yyV
                                                                                                                                                                                                                                                      MD5:9C0ACF12D3D25384868DCD81C787F382
                                                                                                                                                                                                                                                      SHA1:C6E877ABA3FB3D2F21D86BE300E753E23BB0B74E
                                                                                                                                                                                                                                                      SHA-256:825174429CED6B3DAB18115DBC6C9DA07BF5248C86EC1BD5C0DCAECA93B4C22D
                                                                                                                                                                                                                                                      SHA-512:45594FA3C5D7C4F26325927BB8D51B0B88E162E3F5E7B7F39A5D72437606383E9FDC8F83A77F814E45AFF254914514AE52C1D840A6C7B98767F362ED3F4FC5BD
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....................E....q............q......q......q......<.............<......<......<......<.)....<......Rich....................PE..d......_.........." .....(..........D-.......................................0............`.............................................t...4...........@........%........... ..(....d..T................... f..(....d..0............@..0............................text....&.......(.................. ..`.rdata...v...@...x...,..............@..@.data...(...........................@....pdata...%.......&..................@..@.qtmetad............................@..P.rsrc...@...........................@..@.reloc..(.... ......................@..B........................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\plugins\imageformats\qwbmp.dll

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):30192
                                                                                                                                                                                                                                                      Entropy (8bit):5.938644231596902
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:768:EfEM3S46JE2X/xBZ76pC5J6GdDGZUf2h4:63S3JE2PHZ76pC5J6GEUfn
                                                                                                                                                                                                                                                      MD5:68919381E3C64E956D05863339F5C68C
                                                                                                                                                                                                                                                      SHA1:CE0A2AD1F1A46B61CB298CEC5AA0B25FF2C12992
                                                                                                                                                                                                                                                      SHA-256:0F05969FB926A62A338782B32446EA3E28E4BFBFFC0DBD25ED303FAB3404ABAC
                                                                                                                                                                                                                                                      SHA-512:6222A3818157F6BCD793291A6C0380EF8C6B93ECEA2E0C9A767D9D9163461B541AFAF8C6B21C5A020F01C95C6EE9B2B74B358BA18DA120F520E87E24B20836AA
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........]...<.I.<.I.<.I.D%I.<.I.S.H.<.I.W.H.<.I.S.H.<.I.S.H.<.I.S.H.<.IYL.H.<.I.<.I.<.IYL.H.<.IYL.H.<.IYLII.<.IYL.H.<.IRich.<.I........PE..d......_.........." ..... ...8.......'....................................................`......................................... D..t....D..........@....p..T....Z...............6..T...................p8..(...@7..0............0..p............................text............ .................. ..`.rdata..d&...0...(...$..............@..@.data........`.......L..............@....pdata..T....p.......N..............@..@.qtmetad~............R..............@..P.rsrc...@............T..............@..@.reloc...............X..............@..B........................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\plugins\imageformats\qwebp.dll

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):510448
                                                                                                                                                                                                                                                      Entropy (8bit):6.605517748735854
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:12288:bPTjgdqdsvh+LrLrLrL5/y4DVHAsqx3hXS+oPZQqRaYG:jT5sMLrLrLrL5q4dAsaOFo
                                                                                                                                                                                                                                                      MD5:308E4565C3C5646F9ABD77885B07358E
                                                                                                                                                                                                                                                      SHA1:71CB8047A9EF0CDB3EE27428726CACD063BB95B7
                                                                                                                                                                                                                                                      SHA-256:6E37ACD0D357871F92B7FDE7206C904C734CAA02F94544DF646957DF8C4987AF
                                                                                                                                                                                                                                                      SHA-512:FFAEECFAE097D5E9D1186522BD8D29C95CE48B87583624EB6D0D52BD19E36DB2860A557E19F0A05847458605A9A540C2A9899D53D36A6B7FD5BF0AD86AF88124
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.................a....s........s......s......s....>.........>......>.....>....>......>....Rich...................PE..d......_.........." .....B..........tH.......................................0......`q....`..........................................W..t....W..........@.......0H........... ......h...T.......................(.......0............`...............................text...[@.......B.................. ..`.rdata..J....`.......F..............@..@.data....'...........X..............@....pdata..0H.......J...\..............@..@.qtmetadv...........................@..P.rsrc...@...........................@..@.reloc....... ......................@..B........................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\plugins\platforms\qminimal.dll

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):844784
                                                                                                                                                                                                                                                      Entropy (8bit):6.625808732261156
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:12288:y6MhioHKQ1ra8HT+bkMY8zKI4kwU7dFOTTYfEWmTxbwTlWc:BMhioHKQp+bkjAjwGdFSZtbwBd
                                                                                                                                                                                                                                                      MD5:2F6D88F8EC3047DEAF174002228219AB
                                                                                                                                                                                                                                                      SHA1:EB7242BB0FE74EA78A17D39C76310A7CDD1603A8
                                                                                                                                                                                                                                                      SHA-256:05D1E7364DD2A672DF3CA44DD6FD85BED3D3DC239DCFE29BFB464F10B4DAA628
                                                                                                                                                                                                                                                      SHA-512:0A895BA11C81AF14B5BD1A04A450D6DCCA531063307C9EF076E9C47BD15F4438837C5D425CAEE2150F3259691F971D6EE61154748D06D29E4E77DA3110053B54
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........#\..B2..B2..B2..:...B2..-3..B2.F....B2..-7..B2..-6..B2..-1..B2..)6..B2.^23..B2..)3..B2..B3.@2.^26..B2.^27..B2.^22..B2.^2...B2.^20..B2.Rich.B2.........PE..d...N._.........." ......................................................... ............`......................................... ...x.......@.......H....`..H.......................T.......................(.......0...............(............................text...;........................... ..`.rdata...C.......D..................@..@.data...H....@......."..............@....pdata..H....`.......0..............@..@.qtmetad............................@..P.rsrc...H...........................@..@.reloc..............................@..B................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\plugins\platforms\qoffscreen.dll

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):754672
                                                                                                                                                                                                                                                      Entropy (8bit):6.6323155845799695
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:12288:/HpBmyVIRZ3Tck83vEgex5aebusGMIlhLfEWmpCJkl:/HpB63TckUcLaHMITAZmW
                                                                                                                                                                                                                                                      MD5:6407499918557594916C6AB1FFEF1E99
                                                                                                                                                                                                                                                      SHA1:5A57C6B3FFD51FC5688D5A28436AD2C2E70D3976
                                                                                                                                                                                                                                                      SHA-256:54097626FAAE718A4BC8E436C85B4DED8F8FB7051B2B9563A29AEE4ED5C32B7B
                                                                                                                                                                                                                                                      SHA-512:8E8ABB563A508E7E75241B9720A0E7AE9C1A59DD23788C74E4ED32A028721F56546792D6CCA326F3D6AA0A62FDEDC63BF41B8B74187215CD3B26439F40233F4D
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m..T..KT..KT..K]t7K@..K.c.JV..K@g.JV..K.cKU..K.c.JA..K.c.J\..K.c.JP..K.|.JQ..KT..K...K.|.Js..K.|.JS..K.|.JU..K.|[KU..K.|.JU..KRichT..K........PE..d...R._.........." ................L.....................................................`.............................................x...8...........H....... s...h..........p.......T................... ...(.......0...............@............................text............................... ..`.rdata..............................@..@.data...............................@....pdata.. s.......t..................@..@.qtmetad.............T..............@..P.rsrc...H............V..............@..@.reloc..p............Z..............@..B........................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\plugins\platforms\qwebgl.dll

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):482288
                                                                                                                                                                                                                                                      Entropy (8bit):6.152380961313931
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:6144:WO/vyK+DtyaHlIMDhg5WEOvAwKB2VaaHeqRw/yVfYu4UnCA6DEjeYchcD+1Zy2:bKtHOWg5OvAwK0NYu4AShcD+1U2
                                                                                                                                                                                                                                                      MD5:1EDCB08C16D30516483A4CBB7D81E062
                                                                                                                                                                                                                                                      SHA1:4760915F1B90194760100304B8469A3B2E97E2BC
                                                                                                                                                                                                                                                      SHA-256:9C3B2FA2383EEED92BB5810BDCF893AE30FA654A30B453AB2E49A95E1CCF1631
                                                                                                                                                                                                                                                      SHA-512:0A923495210B2DC6EB1ACEDAF76D57B07D72D56108FD718BD0368D2C2E78AE7AC848B90D90C8393320A3D800A38E87796965AFD84DA8C1DF6C6B244D533F0F39
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........gM..#...#...#..~....#.ei&...#.ei'...#.ei ...#..m'...#.ei"...#.(v"...#..m"...#..."...#.(v&...#.(v#...#.(v...#.(v!...#.Rich..#.................PE..d......_.........." .....R...........;....................................................`..........................................m..t...Dn..T.......@....@...=...@..............0...T.......................(.......0............p..(............................text...{Q.......R.................. ..`.rdata..:....p.......V..............@..@.data...H....0......................@....pdata...=...@...>..................@..@.qtmetadz............2..............@..P.rsrc...@............4..............@..@.reloc...............8..............@..B........................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\plugins\platforms\qwindows.dll

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):1477104
                                                                                                                                                                                                                                                      Entropy (8bit):6.575113537540671
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:24576:4mCSPJrAbXEEuV9Hw2SoYFo3HdxjEgqJkLdLu5qpmZuhg/A2b:nPlIEEuV9Hw2SFFWHdWZsdmqja/A2b
                                                                                                                                                                                                                                                      MD5:4931FCD0E86C4D4F83128DC74E01EAAD
                                                                                                                                                                                                                                                      SHA1:AC1D0242D36896D4DDA53B95812F11692E87D8DF
                                                                                                                                                                                                                                                      SHA-256:3333BA244C97264E3BD19DB5953EFA80A6E47AACED9D337AC3287EC718162B85
                                                                                                                                                                                                                                                      SHA-512:0396BCCDA43856950AFE4E7B16E0F95D4D48B87473DC90CF029E6DDFD0777E1192C307CFE424EAE6FB61C1B479F0BA1EF1E4269A69C843311A37252CF817D84D
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                      Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......i...-...-...-...$.%.9.....q.,......8......%......)......+...9......9..,......)..........9..8...-..........d......,.....I.,......,...Rich-...........PE..d....._.........." .....,...h......4+..............................................n.....`.............................................x...(...........H............n..........X....r..T...................Pt..(... s..0............@...5...........................text..._+.......,.................. ..`.rdata.......@.......0..............@..@.data....m...@...D...(..............@....pdata...............l..............@..@.qtmetad.............J..............@..P.rsrc...H............L..............@..@.reloc..X............P..............@..B........................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\plugins\platformthemes\qxdgdesktopportal.dll

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):68592
                                                                                                                                                                                                                                                      Entropy (8bit):6.125954940500008
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:1536:Nt4B1RLj3S6TtH2sweUH+Hz6/4+D6VFsfvUfO:AB1RHFdoeUs6/4O6VFSZ
                                                                                                                                                                                                                                                      MD5:F66F6E9EDA956F72E3BB113407035E61
                                                                                                                                                                                                                                                      SHA1:97328524DA8E82F5F92878F1C0421B38ECEC1E6C
                                                                                                                                                                                                                                                      SHA-256:E23FBC1BEC6CEEDFA9FD305606A460D9CAC5D43A66D19C0DE36E27632FDDD952
                                                                                                                                                                                                                                                      SHA-512:7FF76E83C8D82016AB6BD349F10405F30DEEBE97E8347C6762EB71A40009F9A2978A0D8D0C054CF7A3D2D377563F6A21B97DDEFD50A9AC932D43CC124D7C4918
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o...o...o...f...k......m...{..m......~......h......m......h...o..........k......n.....~.n......n...Richo...........................PE..d...V._.........." .....z...t......T........................................@.......b....`......................................... ................ ..X....................0..4.......T.......................(...p...0...............x............................text....y.......z.................. ..`.rdata...Z.......\...~..............@..@.data...............................@....pdata..............................@..@.qtmetad............................@..P.rsrc...X.... ......................@..@.reloc..4....0......................@..B........................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\plugins\styles\qwindowsvistastyle.dll

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):144368
                                                                                                                                                                                                                                                      Entropy (8bit):6.294675868932723
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:3072:rrjwZ43rCOtrBk7wcR0l7wBlaL6BtIEt51T0Nhkqg8FoQY:7hZu9R0l7wFBtIEt51T0Nuqg8JY
                                                                                                                                                                                                                                                      MD5:53A85F51054B7D58D8AD7C36975ACB96
                                                                                                                                                                                                                                                      SHA1:893A757CA01472A96FB913D436AA9F8CFB2A297F
                                                                                                                                                                                                                                                      SHA-256:D9B21182952682FE7BA63AF1DF24E23ACE592C35B3F31ECEEF9F0EABEB5881B9
                                                                                                                                                                                                                                                      SHA-512:35957964213B41F1F21B860B03458404FBF11DAF03D102FBEA8C2B2F249050CEFBB348EDC3F22D8ECC3CB8ABFDC44215C2DC9DA029B4F93A7F40197BD0C16960
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......R._...1]..1]..1]..]..1]..0\..1]..5\..1]..2\..1]..4\..1]..0\..1]..0\..1]..0]..1]..4\..1]..1\..1]...]..1]..3\..1]Rich..1]........................PE..d...`._.........." .....\...........`.......................................`......wJ....`................................................. ........@..X.... ...............P.........T...................`...(...0...0............p...............................text....Z.......\.................. ..`.rdata......p.......`..............@..@.data...............................@....pdata....... ......................@..@.qtmetadm....0......................@..P.rsrc...X....@......................@..@.reloc.......P......................@..B........................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\translations\qt_ar.qm

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):130
                                                                                                                                                                                                                                                      Entropy (8bit):4.024232093209084
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:3:j2wZC4C/2/vlAlHekW3/S1MUe3/CLlI+rwtbWlMrNtYs8ar/u:Cwm+/PtUePCRIRt6Ygs8y/u
                                                                                                                                                                                                                                                      MD5:8FF05B56C0995F90A80B7064AA6E915C
                                                                                                                                                                                                                                                      SHA1:D5AEB09AE557CEEFB758972EC4AC624CDDC9E6A7
                                                                                                                                                                                                                                                      SHA-256:A8A1B0D6F958E7366D1C856BE61000106D3E7FC993FB931675369892B9002D0B
                                                                                                                                                                                                                                                      SHA-512:5374E0F1D3F5A6A456B00732DE8005787B17ECEF9C8A2B2C1228966A6A8DE211700334D8FD789DAD269F52D0AEED3F5160010CA60909861E270C253B3EA881A4
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:<.d....!..`.......ar....R.....q.t.b.a.s.e._.a.r.....q.t.s.c.r.i.p.t._.a.r.....q.t.m.u.l.t.i.m.e.d.i.a._.a.r..............$...*.

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\translations\qt_bg.qm

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):153
                                                                                                                                                                                                                                                      Entropy (8bit):3.6813848812976975
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:3:j2wZC4C/6lLlAlHekVYtzlY1MUdI7lULlI+rwtbWlMoIFl8IPldkO4t/z:CwDC+7tJjUWhURIRt68f8oiP1z
                                                                                                                                                                                                                                                      MD5:466EED6C184D2055488D4C5EA9AE5F20
                                                                                                                                                                                                                                                      SHA1:8599AB9B731BFC84F6EEC7A0129F396FB8FEC4EA
                                                                                                                                                                                                                                                      SHA-256:9E1CE4D91852352043D9191F1A992838F919CBA7E2F2D9BB1161E494E8BF5F5E
                                                                                                                                                                                                                                                      SHA-512:D2462951EC7DCE3D0851AE9C4ED644FFE0D2A5BDD15B4AE1A4295C187B4295BC854D6A5038DAC0564D165463419D615EB6CE7A9760CEFAD71AB673FB2109C349
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:<.d....!..`.......bg....v.....q.t.b.a.s.e._.b.g.....q.t.s.c.r.i.p.t._.b.g.....q.t.m.u.l.t.i.m.e.d.i.a._.b.g... .q.t.x.m.l.p.a.t.t.e.r.n.s._.b.g.......

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\translations\qt_ca.qm

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):153
                                                                                                                                                                                                                                                      Entropy (8bit):3.631479835393124
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:3:j2wZC4C/NVl/lAlHekUOplY1MUce/hlAlI+rwtbWlMpOflUlIPldkOHlz:CwO4+94jUcerAIRt6a6Uloi8
                                                                                                                                                                                                                                                      MD5:6FBA66FE449866B478A2EBA66A724A02
                                                                                                                                                                                                                                                      SHA1:EBEF6ED8460218CE8DF735659A8CBCD693600AC6
                                                                                                                                                                                                                                                      SHA-256:171C7424B24D8502AB53CB3784FF34D8FCFAE26557CF8AF4DFDDEC6485ACC2FE
                                                                                                                                                                                                                                                      SHA-512:2D2438738C6D10D8A53B46DE5A94BBF993818D080F344D9F1B94FC83D60335D9A5E8EFCC297D593FFF1D427972F9F9502FC31C332CAEA579FC7A88487390457E
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:<.d....!..`.......ca....v.....q.t.b.a.s.e._.c.a.....q.t.s.c.r.i.p.t._.c.a.....q.t.m.u.l.t.i.m.e.d.i.a._.c.a... .q.t.x.m.l.p.a.t.t.e.r.n.s._.c.a.......

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\translations\qt_cs.qm

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):157
                                                                                                                                                                                                                                                      Entropy (8bit):3.7483537099309427
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:3:j2wZC4C/fVFlAlHekUsplY1MUcM/hlULlI+rwtbWlMpsfl8IPldkO1lPchn:CwY4+9ujUcMrURIRt6aE8oinh
                                                                                                                                                                                                                                                      MD5:D033053C03C3ECFA2AA926E0E674F67F
                                                                                                                                                                                                                                                      SHA1:B4E95F8278121E2549F8BB6B5DAF1496F1738A7D
                                                                                                                                                                                                                                                      SHA-256:3C0CBFD19490D67D1B3B9E944C3A4D9A9E7F87D7AE35E88D5D5A0077349B5B21
                                                                                                                                                                                                                                                      SHA-512:2C7E9E9DBE0B25FBA94A52FE4BCCB1D9FED2A7BD2877DB91F82546C3BC8606280949594227BA0FC1C74C31010E1F573B3A82852BE746EAA4F397140485789136
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:<.d....!..`.......cs....v.....q.t.b.a.s.e._.c.s.....q.t.s.c.r.i.p.t._.c.s.....q.t.m.u.l.t.i.m.e.d.i.a._.c.s... .q.t.x.m.l.p.a.t.t.e.r.n.s._.c.s...........

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\translations\qt_da.qm

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):153
                                                                                                                                                                                                                                                      Entropy (8bit):3.6174817344122334
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:3:j2wZC4C/4Jlr/lAlHekT6hY1MUb6JAlI+rwtbWlMuel3UlIPldkOQtt:Cw7rC+3jUkAIRt6EVUloi9
                                                                                                                                                                                                                                                      MD5:E6A683F4A0883B5B0C7D30B847EF208C
                                                                                                                                                                                                                                                      SHA1:FF2440DBBFE04AD86C6F285426AAFD49A895B128
                                                                                                                                                                                                                                                      SHA-256:B5036161CE808C728E5FDA985F792DB565831FD01CF00B282547790C037353A2
                                                                                                                                                                                                                                                      SHA-512:D73B794A71DFD3A3C06BF43ED109F635B4960F9A3904FB728873AB5251BDF6A791DDFDEBA884A2703A35461E18BA902804095AC4B92A2C9361526469B6D35FFA
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:<.d....!..`.......da....v.....q.t.b.a.s.e._.d.a.....q.t.s.c.r.i.p.t._.d.a.....q.t.m.u.l.t.i.m.e.d.i.a._.d.a... .q.t.x.m.l.p.a.t.t.e.r.n.s._.d.a.......

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\translations\qt_de.qm

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):153
                                                                                                                                                                                                                                                      Entropy (8bit):3.6174817344122334
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:3:j2wZC4C/8rJFlAlHekTul01MUbul4LlI+rwtbWlMuallyIPldkOknt:Cw/rJ4+XU5RIRt6Aaoi7t
                                                                                                                                                                                                                                                      MD5:06168E1261BF72F49F94927723B2E1EB
                                                                                                                                                                                                                                                      SHA1:DEAF1B53C3FEE6CB28840418D0060AFA4D59D3FC
                                                                                                                                                                                                                                                      SHA-256:5805B8FF3747849794E2D70661D737C69C15F1AE763C38E17084B1E5A81E9153
                                                                                                                                                                                                                                                      SHA-512:AA3915C029C74DC270514C7F50E8BEC06C825F278E0DE0477AD8ED3187700BBD7711382A6E47C3AC76AC756CEFF9FA8CDD4E9B9DAC817475BC122F78B02C7D7D
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:<.d....!..`.......de....v.....q.t.b.a.s.e._.d.e.....q.t.s.c.r.i.p.t._.d.e.....q.t.m.u.l.t.i.m.e.d.i.a._.d.e... .q.t.x.m.l.p.a.t.t.e.r.n.s._.d.e.......

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\translations\qt_en.qm

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):16
                                                                                                                                                                                                                                                      Entropy (8bit):4.0
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:3:j2wZC4n:CwZ
                                                                                                                                                                                                                                                      MD5:BCEBCF42735C6849BDECBB77451021DD
                                                                                                                                                                                                                                                      SHA1:4884FD9AF6890647B7AF1AEFA57F38CCA49AD899
                                                                                                                                                                                                                                                      SHA-256:9959B510B15D18937848AD13007E30459D2E993C67E564BADBFC18F935695C85
                                                                                                                                                                                                                                                      SHA-512:F951B511FFB1A6B94B1BCAE9DF26B41B2FF829560583D7C83E70279D1B5304BDE299B3679D863CAD6BB79D0BEDA524FC195B7F054ECF11D2090037526B451B78
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:<.d....!..`...

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\translations\qt_es.qm

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):153
                                                                                                                                                                                                                                                      Entropy (8bit):3.6070658648473097
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:3:j2wZC4C/7lJFlAlHekSMthULlI+rwtbWlMvEJY1MUaEf8IPldkOzvt:CwElJ4+7MrURIRt6cujUaE8oi0F
                                                                                                                                                                                                                                                      MD5:EE47DFADBA4414FDC051C5CFBE71DDC1
                                                                                                                                                                                                                                                      SHA1:DE650E96A9C130D35F8A498202773EF7FC875D27
                                                                                                                                                                                                                                                      SHA-256:E25E43F046F61022FFE871A2F73C6A12EDFC5C3EFD958C0E019A721860A053B0
                                                                                                                                                                                                                                                      SHA-512:8C1D8901D2F66CCBF947B831858E08B703517470B2B813B241E00162A275AC9103FF5B9251AD39BD53551E0A4FB45EE74187B218A1EF7C6CF6C5FA9F9219AE04
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:<.d....!..`.......es....v.....q.t.b.a.s.e._.e.s.....q.t.m.u.l.t.i.m.e.d.i.a._.e.s.....q.t.s.c.r.i.p.t._.e.s... .q.t.x.m.l.p.a.t.t.e.r.n.s._.e.s.......

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\translations\qt_fa.qm

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):293121
                                                                                                                                                                                                                                                      Entropy (8bit):5.272179385890926
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:3072:gEo2cQbzaVmvGQYkHkMRKkNeGr+0BhaRsLAChY21rpnLqL9ytnvC58gypn4l4qF:gEZbza0HjeGrxBhaCLFC
                                                                                                                                                                                                                                                      MD5:F9C3624197ACB30A9E6CC799BB65BED6
                                                                                                                                                                                                                                                      SHA1:D715EAE24387DE15588F68C92991A93FAFB5EEAB
                                                                                                                                                                                                                                                      SHA-256:B292AFB0763B8C7C30A5AF7372BFC12D8A0D00BF3DD4A000715D9F576D9C1A39
                                                                                                                                                                                                                                                      SHA-512:199C107AE7EAFCF2A5EEC149CAFEE7ED09B938E204B56AD3AAC9568D27166F61EC8E2225A11AF26F7E1F035FB5CAD98621A01E8A9942D18C273F43B90201162A
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:<.d....!..`.......faB..I....*...u...+...............@.......A...J...B.......C...X...D.......E.......F...%...G.......H...0...I.......P...v...Q.......R.......S.......T..."...U.......V...h...W.......X...s...Y.......]..e....t...................-.......W.......|.......i...;..Eu...;..Z....;...]...;..c....;.......;..0]...M..f....O.......O..2.......#....}..f=...m..fg.........(5......+;..1a..+;...V..+;...!..+O..17..+O...(..1.......E@......F....u..H4......HY...Y..H....S..I....5..I@.....IA......IC......J...1...J.......J.......J...|...K...6...LD......L.......PS......R....Z..T.......Zr.. ...[`...O..[`......\...%@..\...2..._...&l.._...38..1........E..........2u..........1.......1...........@......4G...........................$...L...$..xY...[.......,...u...y...y...y..z.......F.......<.......g.......5W...........9...........f...E...U...E../....E..................0-...%..6....%.........................3......f..........5...?...0..EK...0......0..L ...0..c....0.......0...Z...5...........Y.. D

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\translations\qt_fi.qm

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):117
                                                                                                                                                                                                                                                      Entropy (8bit):3.739162292019161
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:3:j2wZC4C/4HlAlHekRgOp1MUZWJKlI+rwtbWlMsIkk:Cwxe++IUocIRt6Qkk
                                                                                                                                                                                                                                                      MD5:72882942B07B8AAC98034016E752B1A0
                                                                                                                                                                                                                                                      SHA1:BF23B4C136B863B10E770019A2DF62FC988859DF
                                                                                                                                                                                                                                                      SHA-256:048CA42DCE4FAF5FC21D843576E3C6FD963146ECC78554E7E5F34D07F64FB213
                                                                                                                                                                                                                                                      SHA-512:403E7F4E9A0E44F2118804F0781A18EB1852797825498751E3AFA02D9558D90293ABDB570786CED80F7EFF800BEF6D9444A72E6A640D331DA46B2A0EA43C8E96
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:<.d....!..`.......fi....R.....q.t.b.a.s.e._.f.i.....q.t.s.c.r.i.p.t._.f.i.....q.t.m.u.l.t.i.m.e.d.i.a._.f.i.......

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\translations\qt_fr.qm

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):153
                                                                                                                                                                                                                                                      Entropy (8bit):3.680458675741643
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:3:j2wZC4C/FjlAlHekRL21MUZNJOLlI+rwtbWlMs9KIPldkORT:Cw3+SU0RIRt6koio
                                                                                                                                                                                                                                                      MD5:3C45C665CFE036A7474CB4DCBB13CF40
                                                                                                                                                                                                                                                      SHA1:62312DFF3C4CD38BAE8456C981601D0D89600F63
                                                                                                                                                                                                                                                      SHA-256:8624033D849E670B12C9532337FCBF260F20848E044FEE7787CFE2AC92BE28DB
                                                                                                                                                                                                                                                      SHA-512:21659AA452BC2493D915F0BE94F90CDD57759B1F1306AAA2836058D41E80DED24742EBD74E19420021514A6AB4150CA0B447574E96B9D3BF0BC5A8C78DAAF7AC
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:<.d....!..`.......fr....v.....q.t.b.a.s.e._.f.r.....q.t.s.c.r.i.p.t._.f.r.....q.t.m.u.l.t.i.m.e.d.i.a._.f.r... .q.t.x.m.l.p.a.t.t.e.r.n.s._.f.r.......

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\translations\qt_gd.qm

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):70
                                                                                                                                                                                                                                                      Entropy (8bit):4.463523104731333
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:3:j2wZC4C/EXlAlHekQrEuknbJB:CwjO+5JY
                                                                                                                                                                                                                                                      MD5:A8D55457C0413893F746D40B637F9C93
                                                                                                                                                                                                                                                      SHA1:25123615482947772176E055E4A74043B2FBCAA0
                                                                                                                                                                                                                                                      SHA-256:49DF855A004A17950338AF3146466F6DF4D5852410BD0B58EA80E0D0203A9D24
                                                                                                                                                                                                                                                      SHA-512:99718B948D94B292BDEDF6B247A5856BC7AC78408FCC41C980F264C2C8565125786F0289F5F993DCF11B8CDA3AFB2A1D8634B1D0BC9B34992F538F8E4086EC00
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:<.d....!..`.......gd..........q.t.b.a.s.e._.g.d....................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\translations\qt_gl.qm

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):323590
                                                                                                                                                                                                                                                      Entropy (8bit):4.568068046062524
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:3072:OYSG8zxWSDjq73Pf6FT1f4uh50QGrRfFD54YyUY0Ou4/tnra3Z0uYhB5YHfHRRn2:O39WSD3TMQGrxFD5EUVQ
                                                                                                                                                                                                                                                      MD5:0661FFABFBC50187F3BA38876B721946
                                                                                                                                                                                                                                                      SHA1:EB5E7205355CFC6BCB4DF27E224079842C97B296
                                                                                                                                                                                                                                                      SHA-256:204A01AC7DEB6B5BAE193AFECBD1E50D18C73BF7D94BADEB2BBFDF6123C4ED93
                                                                                                                                                                                                                                                      SHA-512:65AB66CC54D65E7678FA731A5C5F2CC9D6FC217B91AD47D538440811E09A23E49CD95CE62A79E3E8C275E250AC1A0B54BD289F6DD067573876DA7AFF54381D02
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:<.d....!..`.......gl_ESB..I....*.......+..&............@.......A...z...B.......C...p...D.......E......F...!...G......H.......I......P...@...Q.......R......S...5...T......U...+...V.......W...a...X.......Y...N...]..o....t..,................F.......p..............4....;..LI...;..bD...;.......;.......;.......;..cJ...M..o1...O..G....O..e.......U....}..oY...m..o........D..(5...X..+;..6/..+;...~..+;......+O..6...+O...N..1......E@...?..F.......H4..'...HY......H...3`..I......I@......IA......IC..0...J...P...J...1...J...0...J.......K...:...LD..2...L...3...PS..:A..R... d..T.......Zr..Rd..[`......[`.....\...WK..\...RR.._...X..._...f...1........E...{......7M..........1.......1....q......O.......9...............*.......)....$... ...$.......[..,=...,..-....y..0X...y...~......Mx......]0.......H......:A......0....9...............E...o...E..b....E.........1.......c....%..;....%...;......3.......^......S................5..4Z...0..L....0.......0..n....0.......0..7....0.......5..9D......!g.

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\translations\qt_he.qm

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):83
                                                                                                                                                                                                                                                      Entropy (8bit):3.880645689209568
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:3:j2wZC4C/YJ/dQlHekfaB21MUXmlvt:CwT0+D/UUt
                                                                                                                                                                                                                                                      MD5:DD5C2C6B148F2DB3E666B859776AE129
                                                                                                                                                                                                                                                      SHA1:8368F32039CC0776A1B95C9DED5FE6C9EA0D93FD
                                                                                                                                                                                                                                                      SHA-256:C113D14E218D5402B616DABEA27969C6F83852676468C5EF051DDDEFB3EE0235
                                                                                                                                                                                                                                                      SHA-512:2EAE33C8707407E083F6B8B05EA2C5B987646DF1553888C16D6508C5A33B2F758DDED73323622CD50324C96F51D61B7CE822F393551A30B211ABD3CC1367249F
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:<.d....!..`.......he....0.....q.t.b.a.s.e._.h.e.....q.t.s.c.r.i.p.t._.h.e.......

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\translations\qt_help_ar.qm

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):8743
                                                                                                                                                                                                                                                      Entropy (8bit):5.189558605179696
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:192:YUM7gBwnG4Vxj4nyn9aAMOJckrL6esm/0sQ5HeK1nvEB:YBkKnZxkyn9aAMWPsm/0sQsGvEB
                                                                                                                                                                                                                                                      MD5:CCD39A7C8139AD041E31B3E5D40968B4
                                                                                                                                                                                                                                                      SHA1:5751BE96817BB6AE7C9DA9F1FBA7F42F31CFCC5D
                                                                                                                                                                                                                                                      SHA-256:222088C9752D1CC3BAB985EF2DC77E5AE78578DCE18A61EC15B39F02E588163D
                                                                                                                                                                                                                                                      SHA-512:9844C0EC65EE1C76DBA021EAC6D476A85E6C8F5BBAF4150C1EA80C0A95BEDE67B5E8F981360EF8599FCECDFCBCB83BC0B8AC44DDEFDCD85F914318030E346967
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:<.d....!..`.......arB.....(.....d.0T....*.5w......Uj....!.`.....M.a[............n..t..............39....&................B<s...V..M^...e......4.O5^...r..)^......o>...........?...t.....D ......k.N.....k.N...C...n...T...I...R..........2>.................|..G.......w....T.......l..........,................^............$a......6.>...........x..K......W.b....._Xn......GN...m..~......!.....J.K.H.............pN.............P.~.....o.....W..(.......~......s.>......%c.....o.....R.z.q..........................n.h................e.....i..........:.J.1. .E.3.E.Q.I..........Untitled.....QHelp.....8.*.9.0.Q.1. .F.3... .E.D.A.Q. .'.D.*.Q.,.E.J.9.).:. .%.1..........Cannot copy collection file: %1.....QHelpCollectionHandler.......*.9.0.Q.1. .%.F.4.'.!. .'.D./.Q.D.J.D.:. .%.1..........Cannot create directory: %1.....QHelpCollectionHandler.....>.*.9.0.Q.1. .%.F.4.'.!. .,./.'.H.D. .A.J. .'.D.E.D.A.Q. .%.1........... Cannot create tables in file %1......QHelpCollectionHandler.....L.*.9.0.Q.1. .*.

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\translations\qt_help_bg.qm

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):10599
                                                                                                                                                                                                                                                      Entropy (8bit):5.192287379770591
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:192:jhYkcd7CYBdmfIOeX3byuJRoZXlBYnEpUYR+BJqO5X9pA2NNrxC0zwRK2nMY762A:a71DQIrLuVCnEtR+DquhN5xC0zwKPYHA
                                                                                                                                                                                                                                                      MD5:5538049DA3A1D1D724AB6E11D2E2EDBE
                                                                                                                                                                                                                                                      SHA1:7256BE390B88A053C0252488C443BE42F6F2D92A
                                                                                                                                                                                                                                                      SHA-256:CBCDD1E0BBAE332D80DDB0A286056F17C824FA28D353D7FDF12FC97D9F6FE054
                                                                                                                                                                                                                                                      SHA-512:DD98CAF3A016968EEDC9106C1839DDECC2D109E9E354708BD74B35E766C6A098C1680C0B867EAD9FCE2E2A6D683BE673B8E5DF1A1B2F1AAFDB31910FF833370F
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:<.d....!..`.......bgB...(.(.......0T......5w... S.Uj......`.......a[....(..........t..............39..........&..........B<s...4..M^..........q...J..%..O5^...O..)^...I..o>...I...J..%.......#....t...A.8dz..$..D ....Z.k.N...<.k.N.......n.......I..............2>...p................G..."...w....................7..,................^............$a....<.6.>..........#...K...........$1.W.b....._Xn......GN...*..~....-..TH.."..!.....5.K.H..#R.........pN..."......&..P.~...@.o.....v..(.........."8..~......s.>.....o.... ..z.q..........................O.h....!t..........e....mi..'.....|.(...@.8.G.8.=.0.B.0. .<.>.6.5. .4.0. .5.,. .G.5. .4.>.:.C.<.5.=.B.0.F.8.O.B.0. .2.A.5. .>.I.5. .A.5. .8.=.4.5.:.A.8.@.0...).........M(The reason for this might be that the documentation is still being indexed.).....QCLuceneResultWidget.........0.1.5.;.5.6.:.0.:..........Note:.....QCLuceneResultWidget.....,. .5.7.C.;.B.0.B.8. .>.B. .B.J.@.A.5.=.5.B.>..........Search Results.....QCLuceneResultWidget....... .

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\translations\qt_help_ca.qm

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):7444
                                                                                                                                                                                                                                                      Entropy (8bit):4.580794980254807
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:192:G8oS34B7n303D37Bn3Jso37cfp3Mg3H373R58noct36R9RFu:GQU7ETrxZvqTXLSoct36Pzu
                                                                                                                                                                                                                                                      MD5:66722ED97BCBFD3DAE3C8264413859AB
                                                                                                                                                                                                                                                      SHA1:400A93B213FCF9BBC9785881EA82ADB9F444CD6C
                                                                                                                                                                                                                                                      SHA-256:ECD4283A660F2CF72849B323810D7EADD063120B6F561E05AA1243A5B280946A
                                                                                                                                                                                                                                                      SHA-512:B898BAC9652D7532384ED5CC53FA62DB55D516421D13F815A3E6D5E80AD4C69555F1A7E6C51F8B0A234614824EEE01D6731458F90D40A585990F84A58B9ABE44
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:<.d....!..`.......caB............%.......0T......K:^.....Uj......`.....P..YJ...V.E.4...*...........>...7........B<s.....B\>...6........+.s.....zq.......9.......vR......@.......@.......:....;.8Z....!.g.N......F................t.....D ....z.k.N.......I......^......`#.......2.......G........N...7......N......{..................K...............GN......NO...5.........K.H...@.........pN......V............q..................>...N.........~.....5..%c...:.z.q....i...4....".A.f.e.g.e.i.x. .u.n. .f.i.l.t.r.e..........Add Filter.....FilterNameDialogClass.......N.o.m. .d.e.l. .f.i.l.t.r.e.:..........Filter Name:.....FilterNameDialogClass.......S.e.n.s.e. .t...t.o.l..........Untitled.....QHelp.....`.N.o. .s.'.h.a. .p.o.g.u.t. .c.o.p.i.a.r. .e.l. .f.i.t.x.e.r. .d.e. .c.o.l...l.e.c.c.i...:. .%.1..........Cannot copy collection file: %1.....QHelpCollectionHandler.....H.N.o. .s.'.h.a. .p.o.g.u.t. .c.r.e.a.r. .e.l. .d.i.r.e.c.t.o.r.i.:. .%.1..........Cannot create directory: %1.....QHelpCollect

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\translations\qt_help_cs.qm

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):15297
                                                                                                                                                                                                                                                      Entropy (8bit):4.708378368926237
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:384:hmv1gdEYEiNrVhTBvAn1ca1f5lwHoJr0vwuxqsP/5jxA:o1gdEvgbloCof9ixqspW
                                                                                                                                                                                                                                                      MD5:ED228F0F60AE9AEC28AB9171D5AE9590
                                                                                                                                                                                                                                                      SHA1:7F061CF0C699D125A5531E3480C21964452F45EA
                                                                                                                                                                                                                                                      SHA-256:4AC56FC63E400943BAB13F1D4C418502138908E1D488C24AEE6131D3D17552AA
                                                                                                                                                                                                                                                      SHA-512:794CC671C08BFC50980820A6389B9D0D3514619AD0A8F18EFD5554CBBF2482192DF00B9D3B05FEE45F42276E63E2375FB28E193930D426245035B4B0E3E14ED8
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:<.d....!..`.......cs_CZB...H.(.......(.......0T......0T......5w...0..Uj......`.......a[......a[....$.......p..........t.......t...........!..1"....T.39....T.39.......s...0......(......7/.................B<s...L..MQ......M^../q..........J..6@.0....*B.O5Q..'..O5^..(A..)Q...X..)^......o>..........+....J..6.......4....t.....8dz..5..D ....R.D ......k.A.....k.A.....k.N.....k.N.......n.."....I..........................2...21......2>..........d.............T..G...4...w...!N......&O......&....!..".......#E..,...,.......)....Q..$/...^..$................$a......6.>.. t......5...K.......K....)......5E.W.b..-.._Xa..%a._Xn..%...GA......GN...?......,9..~.......TH..3..!....*..K.H..4h.........pA...J..pN..........7..P.~.. ..o.....0..(....*..(..........3V..~....T.s.1.....s.>..._.o....0..o....1p.z.q..........'9.....#........^.........h....2................Z..e... .i..8J......(.D.o.v.o.d.e.m. .p.r.o. .t.o. .b.y. .m.o.h.l.o. .b...t.,. .~.e. .d.o.k.u.m.e.n.t.a.c.e. .j.e. .s.t...l.e. .j.e.a.t...

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\translations\qt_help_da.qm

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):4795
                                                                                                                                                                                                                                                      Entropy (8bit):4.530246422531362
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:96:X82wNlnKfN1LMFy7LsF3ZqBFZjWo0koBLqBXXjGL0qU7UqB7zoElmP5MUu4DZIHU:XM01f7eOnoB8X2s7Vfg5Mi4beXiOUu
                                                                                                                                                                                                                                                      MD5:1D09BEE1FB55A173F7EB39B9A662A170
                                                                                                                                                                                                                                                      SHA1:C77F0A148262A91679F19689E4790B754D45D5D5
                                                                                                                                                                                                                                                      SHA-256:6BB092552A398687119F6D52145F04BF8373977446D8F00C0DCBD56B96829F0F
                                                                                                                                                                                                                                                      SHA-512:BE5A31A6135E8DB024A8B0EB20C4D8EECBF76861F83FF83B4CA97327DB74AD94BB5D77B4E0A59A33B697C32A4EACD61B8C878951F2C545385C74D99FCE56FEE1
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:<.d....!..`.......daB.....%.....m.0T......Uj....V.`....................k.B<s.....B\>..........6.+.s...............t.....D ....|.k.N...9...I...O..2.......G....B...N...O..............!..K...._..........GN...........@.K.H.............pN..............>.....~.....m..%c.....z.q....i..........U.n.a.v.n.g.i.v.e.t..........Untitled.....QHelp.....D.K.a.n. .i.k.k.e. .k.o.p.i.e.r.e. .s.a.m.l.i.n.g.s.f.i.l.e.n.:. .%.1..........Cannot copy collection file: %1.....QHelpCollectionHandler.....6.K.a.n. .i.k.k.e. .o.p.r.e.t.t.e. .m.a.p.p.e.n.:. .%.1..........Cannot create directory: %1.....QHelpCollectionHandler.....V.K.a.n. .i.k.k.e. .o.p.r.e.t.t.e. .i.n.d.e.k.s.t.a.b.e.l.l.e.r. .i. .f.i.l.e.n. .%.1...........&Cannot create index tables in file %1......QHelpCollectionHandler.....J.K.a.n. .i.k.k.e. .o.p.r.e.t.t.e. .t.a.b.e.l.l.e.r. .i. .f.i.l.e.n. .%.1........... Cannot create tables in file %1......QHelpCollectionHandler.....P.K.a.n. .i.k.k.e. .i.n.d.l...s.e. .s.q.l.i.t.e.-.d.a.t.a.b.a.s.e.-.d.r

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\translations\qt_help_de.qm

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):7570
                                                                                                                                                                                                                                                      Entropy (8bit):4.550982634910665
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:96:8y/gPmmhL/7LlSivP6kBL7jb0RNUzzpld4UGG3Ik18fLP0L7fGc0OeVP8a8hiAwj:1OD7hx/Bv3oNuFX4iqgv34fZsu
                                                                                                                                                                                                                                                      MD5:3B070D169E3381E2FB081172934AAD00
                                                                                                                                                                                                                                                      SHA1:70886EB7EF566B296D0814BD4C2440AC176699D6
                                                                                                                                                                                                                                                      SHA-256:9962523FBAE9F1E4C3B5C3C16860D059291CB30DC5EBE5A5EDA4C836A03FED1E
                                                                                                                                                                                                                                                      SHA-512:271B730B5A7358E923BBBC6FA074A72DA52FA47E3B7726779EF7034200EDA09BF0E1AE4E7B11B59F76805F48DC285F6EFC245EB9C7F4A748BE82B25CEE1DDCAE
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:<.d....!..`.......deB..........B.%.....5.0T......K:^.....Uj....?.`.....f..YJ...V.E.4...............>............B<s...z.B\>...\........+.s...Q.zq....C..9....4..vR...B..@.......@.......:......8Z......g.N......F....>...........t.....D ......k.N.......I......^....|.`#....I..2....<..G....^...N.........................;..........K....y..........GN......NO...........,.K.H.............pN......V...................."..........>.............~........%c.....z.q....i........".F.i.l.t.e.r. .h.i.n.z.u.f...g.e.n..........Add Filter.....FilterNameDialogClass.....".N.a.m.e. .d.e.s. .F.i.l.t.e.r.s.:..........Filter Name:.....FilterNameDialogClass.......O.h.n.e. .T.i.t.e.l..........Untitled.....QHelp.....\.D.i.e. .K.a.t.a.l.o.g.d.a.t.e.i. .k.a.n.n. .n.i.c.h.t. .k.o.p.i.e.r.t. .w.e.r.d.e.n.:. .%.1..........Cannot copy collection file: %1.....QHelpCollectionHandler.....\.D.a.s. .V.e.r.z.e.i.c.h.n.i.s. .k.a.n.n. .n.i.c.h.t. .a.n.g.e.l.e.g.t. .w.e.r.d.e.n.:. .%.1..........Cannot create directory: %

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\translations\qt_help_en.qm

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):16
                                                                                                                                                                                                                                                      Entropy (8bit):4.0
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:3:j2wZC4n:CwZ
                                                                                                                                                                                                                                                      MD5:BCEBCF42735C6849BDECBB77451021DD
                                                                                                                                                                                                                                                      SHA1:4884FD9AF6890647B7AF1AEFA57F38CCA49AD899
                                                                                                                                                                                                                                                      SHA-256:9959B510B15D18937848AD13007E30459D2E993C67E564BADBFC18F935695C85
                                                                                                                                                                                                                                                      SHA-512:F951B511FFB1A6B94B1BCAE9DF26B41B2FF829560583D7C83E70279D1B5304BDE299B3679D863CAD6BB79D0BEDA524FC195B7F054ECF11D2090037526B451B78
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:<.d....!..`...

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\translations\qt_help_es.qm

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):10704
                                                                                                                                                                                                                                                      Entropy (8bit):4.481291573289571
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:192:q9J9j7e4BQhD0h61nnKz+DJF/45ojDU9V1Wa/rmtIBMH:Wp64ShDnnKz+FhjQpWa/ytoMH
                                                                                                                                                                                                                                                      MD5:9EDF433AB9EE5FC7CF7782370150B26A
                                                                                                                                                                                                                                                      SHA1:A918AE15A0DF187C7789BE8599A80E279F039964
                                                                                                                                                                                                                                                      SHA-256:FD16B279F8CF69077F75E94D90C9C07A2AFFF3948A579E3789F5FFB5E5F4202D
                                                                                                                                                                                                                                                      SHA-512:88245F6FBAAF603A03D7EA2341411AE040791D47C9FF110C6D6CDD8165F0A8BA7A4A0DA5CD543BBE95A4E93FE3A81E95B3664E00C11791FBCB4923E3A80ABC60
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:<.d....!..`.......es_ESB...(.(.....7.0T..../.5w... C.Uj......`.......a[....0..........t..............39..........&e.........B<s...D..M^..............J..%p.O5^...I..)^...1..o>.......J..%.......#....t.....8dz..$..D ......k.N.....k.N.......n.......I..............2>....................G...#...w............!.......%..,................^............$a......6.>..........#...K...........$C.W.b....._Xn......GN...|..~.......TH.."..!.....5.K.H..#f.........pN...j......'..P.~... .o........(....>....."<..~....c.s.>.....o.... ..z.q..........................u.h....!p.......*..e....Qi..'}......(.L.a. .r.a.z...n. .d.e. .e.s.t.o. .p.u.e.d.e. .s.e.r. .q.u.e. .l.a. .d.o.c.u.m.e.n.t.a.c.i...n. .a...n. .e.s.t... .s.i.e.n.d.o. .i.n.d.e.x.a.d.a...).........M(The reason for this might be that the documentation is still being indexed.).....QCLuceneResultWidget.......N.o.t.a.:..........Note:.....QCLuceneResultWidget.....2.R.e.s.u.l.t.a.d.o.s. .d.e. .l.a. .B...s.q.u.e.d.a..........Search Results.....QCLu

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\translations\qt_help_fr.qm

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):10922
                                                                                                                                                                                                                                                      Entropy (8bit):4.459946393010639
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:192:w4BIn67/WsmoB3r6M/eYlSbyE7DnvE7pcn9nPJZe7nOFovzcNn7Uhmio+2/p53I/:w4N19fq3n2c9Bucuhmi52/X3Qpam
                                                                                                                                                                                                                                                      MD5:D520C7F85CC06C66715A2B6622BF0687
                                                                                                                                                                                                                                                      SHA1:47292D068172FBC9DC0D9BE2F479E890A37CE138
                                                                                                                                                                                                                                                      SHA-256:687E351C062F688AAFF6CF05218D6017B80B1A1B4238D1D30250A55EE41C5FED
                                                                                                                                                                                                                                                      SHA-512:736B50BB64751B127300BCAFE88888A9D9A2081CBF934EDCFFEF6CEF0575505AFDF714273A97671ABB598AE3D23C8E55F7DCD632FB0AA219ED5F763768576E04
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:<.d....!..`.......fr_FRB...(.(.....y.0T....K.5w...!1.Uj....*.`.......a[............5..t..............39....m.....'W.......S.B<s...d..M^.. ...........J..&`.O5^...+..)^......o>.......J..&.......$....t.....8dz..%..D ......k.N.....k.N...D...n.......I...........c..2>..........M.........G...$...w....K..................,................^............$a......6.>...c......$...K....'......%M.W.b....._Xn...j..GN......~.......TH..#..!.......K.H..$Z......,..pN..........'..P.~.....o........(....h.....#4..~......s.>...M.o....!..z.q...........p......L.........h...."^.......b..e.....i..(W......(.I.l. .e.s.t. .p.o.s.s.i.b.l.e. .q.u.e. .c.e.l.a. .s.o.i.t. .d... .a.u. .f.a.i.t. .q.u.e. .l.a. .d.o.c.u.m.e.n.t.a.t.i.o.n. .e.s.t. .e.n. .c.o.u.r.s. .d.'.i.n.d.e.x.a.t.i.o.n...).........M(The reason for this might be that the documentation is still being indexed.).....QCLuceneResultWidget.......N.o.t.e. .:..........Note:.....QCLuceneResultWidget.....2.R...s.u.l.t.a.t.s. .d.e. .l.a. .r.e.c.h.e.r.c.h.e.

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\translations\qt_help_gl.qm

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):10891
                                                                                                                                                                                                                                                      Entropy (8bit):4.5087667371046205
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:192:Im7gBZHx4hCTNarW6EJDvoIR765f40wqNcMi/8F/Ihon:v0fHccarW6Eh61wqNcMi/Q/won
                                                                                                                                                                                                                                                      MD5:B62C74793741FC386332A59113E8D412
                                                                                                                                                                                                                                                      SHA1:589CE099F2C1D92581B5CF0E17BE49A2BF0014D4
                                                                                                                                                                                                                                                      SHA-256:7399A248609974773F60866C87B78EA7DFBC4F750313D692F7886CD763883C9F
                                                                                                                                                                                                                                                      SHA-512:D8E1A3B3732662BA572A1387651F2625742710834BEDB41809DA47B5D23020AA1B558B64A00C10C605D1844F0544483163F4A6227CAFFA5ECDABF3BBF4E12D9B
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:<.d....!..`.......gl_ESB...8.(.......0T......Uj......`.....`.a[....F..........t..............1"... S.39.......s...!.............'F.........B<s...8..MQ.. ...........J..&S.0.....x.O5Q......)Q...O..o>...{.......#...J..&.......$....t.....8dz..%..D ......k.A.....k.A.......n.......I.................."...21....................G...#...w............[...!...?...........Q...?........$a....v.6.>..........$...K...........%0._Xa......GA...n..........~.......TH..#..K.H..$M.........pA...Z......'..P.~...B.o........(..........#+..~......s.1.....o....!..z.q...e.............................. ..e....wi..((......(.A. .r.a.z...n. .d.i.s.t.o. .p.o.d.e. .s.e.r. .q.u.e. .a. .d.o.c.u.m.e.n.t.a.c.i...n. .a...n.d.a. .e.s.t.e.a. .a. .i.n.d.e.x.a.r.s.e...).........M(The reason for this might be that the documentation is still being indexed.).....QCLuceneResultWidget.......N.o.t.a.:..........Note:.....QCLuceneResultWidget.....*.R.e.s.u.l.t.a.d.o.s. .d.a. .p.r.o.c.u.r.a..........Search Results.....QCLucene

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\translations\qt_help_hu.qm

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):10284
                                                                                                                                                                                                                                                      Entropy (8bit):4.674501432335502
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:192:RNY+rCG3e7LBqYqYseBb/FEWBgSn62TdJgDO9esYGY3DtgGh621XlZ/8kWvIMK:4+rheHYYZdBb/pgSn62T/FeVD3DGGh62
                                                                                                                                                                                                                                                      MD5:5A56E9E2ED6ECE3F249D1C2A7EB3B172
                                                                                                                                                                                                                                                      SHA1:D6F079F40FBB813B0293C1D2210BAE7084092FEC
                                                                                                                                                                                                                                                      SHA-256:70F33B569C2942F41C6D634EA6A61CB8D80EB2C7011BAD48EF6DBAE9677960D5
                                                                                                                                                                                                                                                      SHA-512:28947128FC51791CFDBFD3958FAF9B33979DB52C90AE0159EDB01FE6032284EB37BC05187162983A0435560BCEA864B008F499CDB4CE662792599FE20A37972A
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:<.d....!..`.......hu_HUB...(.(.......0T......5w......Uj......`.....4.a[....N..........t....".........39..........%..........B<s...8..M^...8..........J..$..O5^......)^...]..o>.......J..$......."N...t.....8dz..#g.D ......k.N...>.k.N.......n.......I..............2>..........a.........G...!...w.......................,................^............$a......6.>.........."...K....m......"..W.b...l._Xn...~..GN......~.......TH..!F.!.......K.H..!..........pN..........%..P.~...<.o........(.......... ...~......s.>...{.o.....c.z.q...K.......v......l.........h.... ........t..e....mi..%.....~.(.E.z. .a.m.i.a.t.t. .l.e.h.e.t.,. .h.o.g.y. .a. .d.o.k.u.m.e.n.t...c.i... .m...g. .i.n.d.e.x.e.l...s. .a.l.a.t.t. .v.a.n...).........M(The reason for this might be that the documentation is still being indexed.).....QCLuceneResultWidget.......M.e.g.j.e.g.y.z...s.:..........Note:.....QCLuceneResultWidget.....&.K.e.r.e.s...s.i. .e.r.e.d.m...n.y.e.k..........Search Results.....QCLuceneResultWidget.......A

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\translations\qt_help_it.qm

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):10612
                                                                                                                                                                                                                                                      Entropy (8bit):4.458970627057882
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:192:nRxcfy71b+myBN16cbc+w45rtlTnzo7uHp3JQJ9cVu4BJ1G82g33vOVrNL/7nEF1:RR4R/fJn9JizTgnqrNL/b0hH2K
                                                                                                                                                                                                                                                      MD5:3639B57B463987F6DB07629253ACD8BF
                                                                                                                                                                                                                                                      SHA1:65935A67C73F19FCF6023FB95030A5ACAF9DA21C
                                                                                                                                                                                                                                                      SHA-256:316FE8D0815E2B4B396895BEB38EF1A40431915B5E054DF80F4C0CD556F26E4B
                                                                                                                                                                                                                                                      SHA-512:AD7CA93D93A69F273CE80BE7F2F477543B9C5F9C7E4D7448223BFF084EA956B626D6837F22D83C5E282688B938F58C29073C4B5C6F26A797F716C14FABF9FFEE
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:<.d....!..`.......it_ITB...(.(.....g.0T....y.5w... ..Uj....2.`.......a[............'..t..............39..........&..........B<s...j..M^...h......K...J..%..O5^...K..)^......o>...u...J..%.......#....t.....8dz..$..D ......k.N.....k.N.......n.......I..............2>.................o..G..."...w............-......./..,................^...'........$a......6.>..........#...K...........$..W.b....._Xn......GN......~.......TH.."n.!.....5.K.H..#"......>..pN..........&..P.~.....o.....~..(....p.....!...~....A.s.>.....o.... ..z.q..........................q.h....!0.......*..e....;i..'!......(.L.a. .c.a.u.s.a. .d.i. .c.i... .p.o.t.r.e.b.b.e. .e.s.s.e.r.e. .c.h.e. .l.'.i.n.d.i.c.i.z.z.a.z.i.o.n.e. .d.e.l.l.a. .d.o.c.u.m.e.n.t.a.z.i.o.n.e. ... .a.n.c.o.r.a. .i.n. .c.o.r.s.o...).........M(The reason for this might be that the documentation is still being indexed.).....QCLuceneResultWidget.......N.o.t.a.:..........Note:.....QCLuceneResultWidget.......R.i.s.u.l.t.a.t.i. .d.e.l.l.a. .r.i.c.e.r.c.

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\translations\qt_help_ja.qm

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):7917
                                                                                                                                                                                                                                                      Entropy (8bit):5.680408580146589
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:192:mP6J37GcBzRjYEPEJJGTnwfJJxb7FTPjzzZBL3/q/I53:mSVqclR5s6Tnwfb7Pj/PL3/q/w3
                                                                                                                                                                                                                                                      MD5:1380A9352C476071BDA5A5D4FED0B6C5
                                                                                                                                                                                                                                                      SHA1:9B737ED05F80FE5D3CD8F588CCEC16BB11DD3560
                                                                                                                                                                                                                                                      SHA-256:AE603B2C0D434D40CDE433FFCBA65F9EE27978A9E19316007BE7FE782A5B8B47
                                                                                                                                                                                                                                                      SHA-512:EC3D68126488C3A163898BACAF7E783217868573635182CAF511ED046B4BE1F99A71FBB24DA607CCB50EDAF70893007AAEE9A6BAAE4C1CD33465A0915AA965DA
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:<.d....!..`.......jaB...(.(.....S.0T......5w....'.Uj......`.......a[............u..t............!.39.....................B<s......M^..............J...>.O5^...O..)^......o>.......J...............t...w.8dz.....D ......k.N.....k.N...H...n.......I...........i..2>...<......G......9..G....P..w............i..........,................^..........'.$a......6.>...5..........K............S.W.b...2._Xn......GN...@..~.......TH.....!.......K.H.............pN...........S.P.~.....o.....|..(..............~....o.s.>.....o.......z.q..................@.........h.....&....... ..e.....i........@.(0.0.0.0.0.0.0n}"_.0nO\b.0L}BN.0W0f0D0j0D0_0.0K0.0W0.0~0[0.0..).........M(The reason for this might be that the documentation is still being indexed.).....QCLuceneResultWidget......l..:..........Note:.....QCLuceneResultWidget......i.}"}Pg...........Search Results.....QCLuceneResultWidget.....R0.0.0.0.0.0.0n}"_.0nO\b.0L}BN.0W0f0D0j0D0_0.0.i.}"}Pg.0LN.[.Qh0jS..`'0L0B0.0~0Y0..........VThe search results may

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\translations\qt_help_ko.qm

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):5708
                                                                                                                                                                                                                                                      Entropy (8bit):5.698914195742074
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:96:elPQHJ6L4c7LaQaFQv2QEhBL+Ejma0W40U0BzlQlcrnUSaTIdspIc18CLRSM3LBY:dHI97W1BbNz1VqqzJpoj5y5uY7OGrWFE
                                                                                                                                                                                                                                                      MD5:CD15674A652C2BF435F7578E119182F8
                                                                                                                                                                                                                                                      SHA1:AEA22E4A0D21396733802C7AB738DDD03737B7D6
                                                                                                                                                                                                                                                      SHA-256:F11C64694E8E34E1D2C46C1A1D15D6BA9F2DB7B61DE4FDF54ECA5AB977C3E052
                                                                                                                                                                                                                                                      SHA-512:88BFA112F4DBC0BFB4013CE0937E5180B4AB4A217FC8A963798C7C86532E794E4A1AD88416AE42F26A1C0631B465A5D69BFE75366E048502F5E21F4115A12F19
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:<.d....!..`.......koB............%.......0T......K:^...g.Uj......`........YJ...>.E.4...........z...>..........;.B<s...K.B\>...b........+.s.....zq....[..9....F..vR......@.......@.......:....c.8Z......g.N...7..F....|...........t.....D ......k.N.......I...m..^......`#....!..2.......G....@...N.................................X..K....{.......i..GN......NO.............K.H..........S..pN...z..V...............................>...........:.~.....i..%c.....z.q....i...s......D.0. .............Add Filter.....FilterNameDialogClass.......D.0. .t...:..........Filter Name:.....FilterNameDialogClass........... ...L..........Untitled.....QHelp.....(...L... ...|.D. .....`. ... ...L.:. .%.1..........Cannot copy collection file: %1.....QHelpCollectionHandler.....".....0...|. .... ... ...L.:. .%.1..........Cannot create directory: %1.....QHelpCollectionHandler.....2...|. .%.1... ...x. .L.t...D. .... ... .................&Cannot create index tables in file %1......QHelpCollectionHandler.....,.

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\translations\qt_help_pl.qm

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):9673
                                                                                                                                                                                                                                                      Entropy (8bit):4.622652249027856
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:192:TO/7kBL9wGu3wtCnlhLJUBB7oph+mZ18LgP:T8QnwcCnlhdvphpZ18LgP
                                                                                                                                                                                                                                                      MD5:2B68446B69D9AA40B273D75A581D2992
                                                                                                                                                                                                                                                      SHA1:8A09BD38998543B74E2673478EDD54FB4BBDD068
                                                                                                                                                                                                                                                      SHA-256:CC6CB4D8C54086224672F2E49E623C8CB7C0C1CD65B8D5ECD42FC9BA3A6065BD
                                                                                                                                                                                                                                                      SHA-512:F3A3D6A416B3411613B06FC3EE56625D4D4DE80087182AB0D0601E49314861ABEF97D11A15B4C0511911544A59FBC4A4A52F0CCF0FD43F763A76A8922D8E57B6
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:<.d....!..`.......plB.....(.......0T....T.5w......Uj... R.`.......a[...............t............2.39....H......6.......n.B<s.. ...M^..._......6.O5^...F..)^......o>...............t.....D ......k.N.....k.N.../...n.......I...W..........2>...w................G.......w............&.......:..,................^...(..... ..$a....?.6.>...$..........K......W.b....._Xn......GN...Y..~......!.....*.K.H...E....."...pN...-.........P.~...}.o........(....1..~......s.>......%c.."..o.....r.z.q............................h................e.....i..#.......N.i.e.n.a.z.w.a.n.y..........Untitled.....QHelp.....P.N.i.e. .m.o.|.n.a. .s.k.o.p.i.o.w.a... .p.l.i.k.u. .z. .k.o.l.e.k.c.j...:. .%.1..........Cannot copy collection file: %1.....QHelpCollectionHandler.....>.N.i.e. .m.o.|.n.a. .u.t.w.o.r.z.y... .k.a.t.a.l.o.g.u.:. .%.1..........Cannot create directory: %1.....QHelpCollectionHandler.....H.N.i.e. .m.o.|.n.a. .u.t.w.o.r.z.y... .t.a.b.e.l. .w. .p.l.i.k.u. .%.1........... Cannot create tables in file

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\translations\qt_help_ru.qm

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):7288
                                                                                                                                                                                                                                                      Entropy (8bit):5.297177914619657
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:192:dBJjvfq7D6X68uBAzlp5W9+yBPZZZMM7vL0PXJL:JKrMEL0PXJL
                                                                                                                                                                                                                                                      MD5:794AF445A5D7082D51BD22683449F86D
                                                                                                                                                                                                                                                      SHA1:3A0C369872B112A1572AA17EEB814B168B225D98
                                                                                                                                                                                                                                                      SHA-256:557B644E6DA5F1EC720EF93965617087E4D1F40B2494CC5AA524CF3796108DE7
                                                                                                                                                                                                                                                      SHA-512:D42C870A16AEE7626BBE24886AD423895529A2F1A51AC2DBC303BC0E4EF9D3241FE894ECA3F7217AD408C8DCEE165CA4B89D84570357B0EB80340A3F72B0A846
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:<.d....!..`.......ruB..........\.%.......0T......K:^.....Uj....L.`........YJ...X.E.4...............>............B<s.....B\>............+.s.....zq.......9....B..vR...L..@.......@....G..:......8Z......g.N......F....>...........t.....D ....R.k.N...E...I...W..^......`#....s..2.......G....^...N.........................K.......d..K............O..GN...b..NO.............K.H.............pN...P..V....................g..........>.............~........%c.....z.q....i........$...>.1.0.2.;.5.=.8.5. .D.8.;.L.B.@.0..........Add Filter.....FilterNameDialogClass.........<.O. .D.8.;.L.B.@.0.:..........Filter Name:.....FilterNameDialogClass.........5.7.K.<.O.=.=.K.9..........Untitled.....QHelp.....b...5. .C.4.0.;.>.A.L. .A.:.>.?.8.@.>.2.0.B.L. .D.0.9.;. .:.>.;.;.5.:.F.8.8. .A.?.@.0.2.:.8.:. .%.1..........Cannot copy collection file: %1.....QHelpCollectionHandler.....<...5. .C.4.0.;.>.A.L. .A.>.7.4.0.B.L. .:.0.B.0.;.>.3.:. .%.1..........Cannot create directory: %1.....QHelpCollectionHandler.....`

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\translations\qt_help_sk.qm

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):10388
                                                                                                                                                                                                                                                      Entropy (8bit):4.70568613551943
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:192:uPq7iBWseXKkVu4+Qv9zEJ1xGMaLNmBgJqdC6/MxIMt:LWcseV04Xv9zEoLNDJqdX/MxRt
                                                                                                                                                                                                                                                      MD5:75C94E59F1FC5312AE25381C247AF992
                                                                                                                                                                                                                                                      SHA1:E3E5F4582CC5FAFE6DF43644D11484861023C084
                                                                                                                                                                                                                                                      SHA-256:F41E33E1D790BD0D3EB180F1F875BC191FE74773628F25C2CAD95E1402E66867
                                                                                                                                                                                                                                                      SHA-512:959B8F4D57FC9728DD4804322333D1792D45A0EE85615B559E0CA3BD2DEA22E2C8C68C6482AE9425D29C819B0ED27473EDDC82EF4B6ECFFB2E2E7B56E1509B63
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:<.d....!..`.......sk_SKB...8.(.......0T......Uj......`.....0.a[....8..........t..............1"......39.......s........... .....%..........B<s...6..MQ..............J..$-.0.......O5Q......)Q...;..o>...........G...J..$......."....t.....8dz..#..D ......k.A...2.k.A.......n..._...I.................. ...21..........e.........G...!...w....Y...........!...........=...Q............$a......6.>.........."...K....i......# ._Xa..."..GA..............~.......TH..!{.K.H.."7.........pA..........%..P.~.....o........(..........!...~....u.s.1.....o.......z.q...c..............................f..e....9i..&-......(.D...v.o.d.o.m. .m...~.e. .b.y.e. .t.o.,. .~.e. .d.o.k.u.m.e.n.t...c.i.a. .s.t...l.e. .n.i.e. .j.e. .z.i.n.d.e.x.o.v.a.n.....).........M(The reason for this might be that the documentation is still being indexed.).....QCLuceneResultWidget.......P.o.z.n...m.k.a.:..........Note:.....QCLuceneResultWidget.....".V...s.l.e.d.k.y. .h.>.a.d.a.n.i.a..........Search Results.....QCLuceneResultWidg

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\translations\qt_help_sl.qm

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):10363
                                                                                                                                                                                                                                                      Entropy (8bit):4.613473842638716
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:192:vNBqTi7qBCVIQf54EslZ2Jy/L/BnmpP0bX3caK6q1B6/hgIlCCUb0:vjq2+UVT4ESZOYmpP0bX26q1I/yqCCUw
                                                                                                                                                                                                                                                      MD5:3B0AEE27B193A8A563C5CB5C7C4FE60F
                                                                                                                                                                                                                                                      SHA1:C94E832595EC765370553468F87C02DB7E7D138A
                                                                                                                                                                                                                                                      SHA-256:2EC955E662407EBCD8DCDAE5AAA21E4108E0B5B0AEE0E9DB712C27072943535F
                                                                                                                                                                                                                                                      SHA-512:EBC25C378126876F44279E23CA0CF06FC9E7D5F51AD7E3DBDABA7A50C81112EDC1C76F7FD0AF47E447A93C3593BB953A0C9C1FBBFC49494E6B29BF21655F690E
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:<.d....!..`.......slB...8.(.....E.0T......Uj......`.......a[............!..t..............1"....;.39.......s....^............$........i.B<s...,..MQ..........}...J..#..0.....Z.O5Q...[..)Q......o>...............J..$I......"W...t...C.8dz..#H.D ......k.A.....k.A.......n.......I.................. P..21....................G...!...w............?...!...3...........Q...+........$a....>.6.>.........."...K...........".._Xa......GA..............~....A..TH..!I.K.H..!..........pA...>......%..P.~...>.o........(....d..... ...~......s.1.....o.......z.q.....................................e....{i..&.....z.(.R.a.z.l.o.g. .j.e. .m.o.r.d.a. .t.o.,. .d.a. .s.e. .d.o.k.u.m.e.n.t.a.c.i.j.o. .a.e. .v.e.d.n.o. .i.n.d.e.k.s.i.r.a...).........M(The reason for this might be that the documentation is still being indexed.).....QCLuceneResultWidget.......O.p.o.m.b.a.:..........Note:.....QCLuceneResultWidget.....".R.e.z.u.l.t.a.t.i. .i.s.k.a.n.j.a..........Search Results.....QCLuceneResultWidget.......R.e.

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\translations\qt_help_tr.qm

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):4629
                                                                                                                                                                                                                                                      Entropy (8bit):4.68793836539357
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:96:BoiK0UD2wMLb7Lqlguotqbww5BLNwWjK0kHU9zuQlUVUfniqthweEIFwC18lLEGA:PXFf7pU75BWWOpcJcVqDFNz8brgyf76r
                                                                                                                                                                                                                                                      MD5:32D6EE3D8EE6408A03E568B972F93BCB
                                                                                                                                                                                                                                                      SHA1:582EE079DBD42000C378E0701D26405750524DBA
                                                                                                                                                                                                                                                      SHA-256:EBDECA0CFEE7A9441DEB800BABFD97C63BC4E421DA885C55B3BD49725EBACD25
                                                                                                                                                                                                                                                      SHA-512:24AAA30B9CB4DB82A57411FBA24A87D70D8B845AE48A6FDA633D0BE6B824B58FDD2F450C2B385F16F49E2F9C6FA0A3124FD0F28594726940F996C66F8F3216CC
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:<.d....!..`.......tr_TRB.....%.....[.0T......Uj......`.....$..............L.B<s.....B\>..........4.+.s...............t.....D ......k.N...5...I......2.......G....5...N..........a...............f..K....9..........GN...........@.K.H..........q..pN...t..........>...z.~...../..%c.....z.q....i..........B.a._.l.1.k.s.1.z..........Untitled.....QHelp.....J.K.o.l.e.k.s.i.y.o.n. .d.o.s.y.a.s.1. .k.o.p.y.a.l.a.n.a.m.1.y.o.r.:. .%.1..........Cannot copy collection file: %1.....QHelpCollectionHandler.....2.D.i.z.i.n. .o.l.u._.t.u.r.u.l.a.m.1.y.o.r.:. .%.1..........Cannot create directory: %1.....QHelpCollectionHandler.....\.%.1. .d.o.s.y.a.s.1.n.d.a. .d.i.z.i.n. .t.a.b.l.o.l.a.r.1. .o.l.u._.t.u.r.u.l.a.m.1.y.o.r...........&Cannot create index tables in file %1......QHelpCollectionHandler.....N.%.1. .d.o.s.y.a.s.1.n.d.a. .t.a.b.l.o.l.a.r. .o.l.u._.t.u.r.u.l.a.m.1.y.o.r........... Cannot create tables in file %1......QHelpCollectionHandler.....P.S.q.l.i.t.e. .v.e.r.i.t.a.b.a.n.1. .s...r...c...

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\translations\qt_help_uk.qm

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):9750
                                                                                                                                                                                                                                                      Entropy (8bit):5.281035122342072
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:192:eMp79BCN+u8hhbHbny+HJouHgei50JBSfDvbetpP/RIkT:eIhgNgBbny+phiS3SfDDetpP/RRT
                                                                                                                                                                                                                                                      MD5:90A776917D534B65942063C319573CDC
                                                                                                                                                                                                                                                      SHA1:5DF3B213D985A3BBDB476B37B7780D7D7DF17E41
                                                                                                                                                                                                                                                      SHA-256:497CFC473684692EE44D7A3795E8FB2270C57069FD9EB98A615DD29AB9BE8A7C
                                                                                                                                                                                                                                                      SHA-512:B34A019716B50CE8E1E20AC32756B3B0D5802971F7A04F4BDDE2418DA551AFB9742B79E934979DB6FAB9DAC05D7D26A3B19ABA77158321F8D9AAB08AEBBD455A
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:<.d....!..`.......uk_UAB...(.(.....?.0T......5w......Uj......`.......a[...............t............K.39....u....."..........B<s...8..M^...j......y...J..!..O5^...Y..)^......o>...o...J..":...... <...t...E.8dz..!3.D ....".k.N.....k.N...d...n.......I..............2>...>......o.........G.......w............E.......e..,................^...S........$a......6.>...'...... y..K........... ..W.b....._Xn......GN...p..~.......TH...4.!.....9.K.H.............pN..........#].P.~...~.o.....N..(....b.........~......s.>.....o.....o.z.q..........................U.h.............D..e.....i..#.......(...@.8.G.8.=.>.N. .F.L.>.3.>. .<.>.6.5. .1.C.B.8. .B.5.,. .I.>. .4.>.:.C.<.5.=.B.0.F.V.O. .4.>.A.V. .V.=.4.5.:.A.C.T.B.L.A.O...).........M(The reason for this might be that the documentation is still being indexed.).....QCLuceneResultWidget.........@.8.<.V.B.:.0.:..........Note:.....QCLuceneResultWidget.....". .5.7.C.;.L.B.0.B.8. .?.>.H.C.:.C..........Search Results.....QCLuceneResultWidget....... .5.7

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\translations\qt_help_zh_CN.qm

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):6441
                                                                                                                                                                                                                                                      Entropy (8bit):5.790303416386852
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:192:pB37nBD4H5PCyLDxLSzJPduYx9vja/FIgH9yIFqfs:rTZ4HUAD1S1JFe/F59PFqfs
                                                                                                                                                                                                                                                      MD5:9297A6905B8B1823BF7E318D9138A104
                                                                                                                                                                                                                                                      SHA1:3DB992A1B3BBCAF314B7EA4A000D6334D7492A52
                                                                                                                                                                                                                                                      SHA-256:C02AAA20923F18ADDAB520BE5CB84EFD4C723396BDC24B4C9A72D406F101C7B4
                                                                                                                                                                                                                                                      SHA-512:01F12CEE0AE456D78942A6049E1C77F94B406C8FFB4A5944DE15E54D1C760CDBA13279530A8F29B1443D1BBC647D3AF5436AAD8C43EB3944316C48300B3827E4
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:<.d....!..`.......zhB......I....L.0T......Uj......`.......a[...............t....P..@....Z.......<.........39.......s....2.................B<s......MQ..........9...J......31.....0.......O5Q......)Q...^..o>...........(...........J...V...........t.....8dz.....D ....Z.k.A.....k.A.......n.......I...........t..w................!...........o.......D...Q...E........$a......6.>...h...............%._Xa......GA..........._..TH...r.........pA.............P.~.....o.....].~.q.............~......o.....h.z.q...........H..0q....................i........2..S.u...y.`.Q.v.S.V.S..f/V.N:..e.hckcW(..}"_.0............M(The reason for this might be that the documentation is still being indexed.).....QCLuceneResultWidget......l..............Note:.....QCLuceneResultWidget......d.}"~.g...........Search Results.....QCLuceneResultWidget.....,d.}"~.g.N_..^vN.[.et..V.N:..e.hckcW(..}"_............VThe search results may not be complete since the documentation is still being indexed!.....QCLuceneResultWidget..

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\translations\qt_help_zh_TW.qm

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):9301
                                                                                                                                                                                                                                                      Entropy (8bit):5.80411750798786
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:192:4bgIXwsL78BQp4dRDP0ludqODa/wkB/tTWn5dJ6mO8IZiT9Dzz/wI3HyRWqUqS:lI/oS4dR5c/tTWn5/EZA9D/w+H8WqUqS
                                                                                                                                                                                                                                                      MD5:47C3328D3918CF627112BB6C50E30B86
                                                                                                                                                                                                                                                      SHA1:05705603AB3F28402A6C103E1C41DDFF21D140C0
                                                                                                                                                                                                                                                      SHA-256:3697F1660D7F2AC9B37AC33CD1C7ECAE08ADBD26710E7E0076497CCDDC8BC830
                                                                                                                                                                                                                                                      SHA-512:8DE1C3C5A48965CF6D8AA545DA9F0A5C00AE124F3E4153597915E7C0F4CAE1E26723270F58A47AA9FFA4AAF30E6EBA522D4EBAD27DECF17EF108E353E611980E
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:<.d....!..`.......zh_TWB......I....[.%.......0T......0T......Uj......Uj....R.`.....>.a[....................g..t....7..@......................39.......s................... .........B<s.....B<s.....B\>......MQ..........[...J...]..31.....+.s...c.0.....U.O5Q......)Q...C..o>.......................J...............t...3...t.....8dz.....D ....R.D ......k.A.....k.A.....k.N...'...n.......I.......I...........[..2....x..G........N......w................!...........:...........Q...&...............$a......6.>...I.......L.......$..K......................_Xa...y..GA...O..GN...........$..........TH...I.K.H................ Y..pA...K..pN.............P.~.....o.....D.~.q......>.............~......~........%c.. ..o.....!.z.q...........#..0q....................i..!Y....(..g.S..f/V.p.N.W(^.z.e.N.v.}"_.uvN-0............M(The reason for this might be that the documentation is still being indexed.).....QCLuceneResultWidget......P..;............Note:.....QCLuceneResultWidget......d.\.}Pg...........Sea

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\translations\qt_hu.qm

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):146
                                                                                                                                                                                                                                                      Entropy (8bit):3.6255640074603277
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:3:j2wZC4C/IrLlAlHekfK/gp1MUXaMlI+rwtbWlMiayIPldkOgn:CwDrC+TYIUrIRt6HoiHn
                                                                                                                                                                                                                                                      MD5:5A46979B45C67DD6312F33CCEA2ED7BC
                                                                                                                                                                                                                                                      SHA1:4C56836B1FB10D9903B299CBCB925947D515B4C8
                                                                                                                                                                                                                                                      SHA-256:BB246AABD501E14CED8B1FFC1369E3D5D26567AAE62B3EAD4D94C22FB77C3471
                                                                                                                                                                                                                                                      SHA-512:BDBA4E1731CF254E95B0F1337410937C765E96FBB1D42F1D053033E1511FEE6F50C02705F781F4DAA0347E2299DC78A5A9942AC4EA343ED1F8F401F9ACD961E4
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:<.d....!..`.......hu....v.....q.t.b.a.s.e._.h.u.....q.t.s.c.r.i.p.t._.h.u.....q.t.m.u.l.t.i.m.e.d.i.a._.h.u... .q.t.x.m.l.p.a.t.t.e.r.n.s._.h.u

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\translations\qt_it.qm

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):153
                                                                                                                                                                                                                                                      Entropy (8bit):3.5752972123113778
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:3:j2wZC4C/EbFlAlHeke5zOp1MUWLt7KlI+rwtbWlMj5FKIPldkOA9kk:CwDM+35aIUW5SIRt6Q50oi9Gk
                                                                                                                                                                                                                                                      MD5:2BB8C94D420D3BC344C79A01043BDC89
                                                                                                                                                                                                                                                      SHA1:3FBA773D58E6D3699C20AB41AEE6801E71E2DDAE
                                                                                                                                                                                                                                                      SHA-256:9117AAC2D07BC86DFA55A29B8825ED27C7093300FCC90E143E135E00E85F09D7
                                                                                                                                                                                                                                                      SHA-512:C6B13655AFB206B0056F5656B4A9BF33CC267FCC928F6973258131CFA6443970510226FE45A041E5AA988809E17D0B11C7458F4A241C71521EDED186596C6055
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:<.d....!..`.......it....v.....q.t.b.a.s.e._.i.t.....q.t.s.c.r.i.p.t._.i.t.....q.t.m.u.l.t.i.m.e.d.i.a._.i.t... .q.t.x.m.l.p.a.t.t.e.r.n.s._.i.t.......

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\translations\qt_ja.qm

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):146
                                                                                                                                                                                                                                                      Entropy (8bit):3.599979504080125
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:3:j2wZC4C/il/lAlHekd6hY1MUV6JAlI+rwtbWlMgel3UlIPldkOG:Cwz4+pjUGAIRt6qVUloiB
                                                                                                                                                                                                                                                      MD5:8A1EE3433304838CCD0EBE0A825E84D8
                                                                                                                                                                                                                                                      SHA1:2B3476588350C5384E0F9A51FF2E3659E89B4846
                                                                                                                                                                                                                                                      SHA-256:23457CE8E44E233C6F85D56A4EE6A2CECD87C9C7BDDE6D8B8A925902EED1CD9C
                                                                                                                                                                                                                                                      SHA-512:2D8ACD668DF537E98B27161F9FA49828EB2EB6E9CF41DB38E7F5D31F610D150CD1B580A8AE9B472A4DFDE4D4BF983C24A56293BB911CF5879368664E4D4CF3D2
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:<.d....!..`.......ja....v.....q.t.b.a.s.e._.j.a.....q.t.s.c.r.i.p.t._.j.a.....q.t.m.u.l.t.i.m.e.d.i.a._.j.a... .q.t.x.m.l.p.a.t.t.e.r.n.s._.j.a

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\translations\qt_ko.qm

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):146
                                                                                                                                                                                                                                                      Entropy (8bit):3.652277257665055
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:3:j2wZC4C/rrr/lAlHekcQ/01MUUQMlI+rwtbWlMhQGlIPldkORn:CwCC+1Q/UUpIRt6SBloimn
                                                                                                                                                                                                                                                      MD5:7B2659AF52B824EAC6C169CDD9467EE9
                                                                                                                                                                                                                                                      SHA1:5727109218B222E3B654A8CC9933E970EB7C2118
                                                                                                                                                                                                                                                      SHA-256:4CC1AF37E771F0A43898849CFF2CD42A820451B8D2B2E88931031629D781DB05
                                                                                                                                                                                                                                                      SHA-512:E9475AC80BDBBEFF54F2724A2B6BA76992F18FD1913FD8EE1540A99FD7A112B79FED5A130B6AC6D7460E4420C06354FC6E4CF7770A7C6CBD3EAC1BDAF0082DE5
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:<.d....!..`.......ko....v.....q.t.b.a.s.e._.k.o.....q.t.s.c.r.i.p.t._.k.o.....q.t.m.u.l.t.i.m.e.d.i.a._.k.o... .q.t.x.m.l.p.a.t.t.e.r.n.s._.k.o

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\translations\qt_lt.qm

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):165383
                                                                                                                                                                                                                                                      Entropy (8bit):4.805977227348512
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:1536:i5v3+zmayloj6yJjhnBAbnrKnGrhA7WgdXclIsooY9i:SvOzAloj6yJ9BA7riGr+7WKXc+s5ui
                                                                                                                                                                                                                                                      MD5:8992B652D1499F5D2F12674F3F875A35
                                                                                                                                                                                                                                                      SHA1:E22766A49612F79156C550D83C6C230345DDA433
                                                                                                                                                                                                                                                      SHA-256:47EB5F97467DF769261421D54A5BEA1131C9FB9B6388791D38BB6574335B64BF
                                                                                                                                                                                                                                                      SHA-512:9B8B6DBFF432F2A46C14BC183A6BAF84ACBF02BF2C5BB8C306C6538FBD9BE1C0A9015BD46728F2F652F9163AFC56B1E16D16EB95D8F7728F3C562AE9F4F1AE1E
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:<.d....!..`.......ltB..0X...*..)C...+...|......P....@..9....A..9....B..:....C..:....D..;....E..;....F..<6...G..<....H..=)...I..=....P..>q...Q..>....R..?....S..@f...T..@....U..A\...V..B....W..B....X..C....Y..Cy...]..k....t..........t>......th......t.......pd...;..J'...;.._h...;.......;...{...;..J....;...)...M..l....O...R...O...............}..l9...m..lo......^S..(5..P{..+;..4...+;......+;......+O..4...+O......1...^...E@..?p..F...C...H4......HY......H.......I...D...I@..s...IA..t...IC...2..J.......J....Y..J.......J.......K...9...LD...`..L.......PS......R.......T...q...Zr...`..[`......[`..&@..\....e..\....b.._......._....P..1........E..........5........L..1...O...1...PP......7......../...........$.......$.......,.......y.......y..........K^..............x......8................L...E.......E.......E..*....................%..:....%.........0U.....W......Zo.....^....5.......0..I....0...F...0...|...0.......0.......0..+\...5...}.......... D...g.. D......+....j..,.......,.......<U...+..<U

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\translations\qt_lv.qm

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):89
                                                                                                                                                                                                                                                      Entropy (8bit):4.156834975253888
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:3:j2wZC4C/HzllldQlHekbxplUp1MUTJ+b:Cwv+DIUEb
                                                                                                                                                                                                                                                      MD5:19F1B919BB531E9E12E7F707BEBD8497
                                                                                                                                                                                                                                                      SHA1:46E82683CEA28D877C73A5CE02F965BB1130FC62
                                                                                                                                                                                                                                                      SHA-256:03467738042A15676E504BA02CB326DCDB773B171FADA3CD62B7A0E0564314A0
                                                                                                                                                                                                                                                      SHA-512:901D7B26CAC7A4D0FFDB39A1D25767B5BC71BED4AFBE788D70BF19D4C58A8295167111675AB45E743FDF4768AF874D69417414C01CF23D5C525A3F6C8BF7D21F
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:<.d....!..`.......lv....0.....q.t.b.a.s.e._.l.v.....q.t.s.c.r.i.p.t._.l.v........)....

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\translations\qt_pl.qm

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):161
                                                                                                                                                                                                                                                      Entropy (8bit):3.8693516202048612
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:3:j2wZC4C/5J/p/lAlHekHp/7KlI+rwtbWlM6Tl/z21MUPp/FOlIPldkOjehB:Cwr+26IRt6nFURkloiT
                                                                                                                                                                                                                                                      MD5:D71EA9FEFD97464B178235150EC8759E
                                                                                                                                                                                                                                                      SHA1:61026FE602FD1B8B442A0D341C6BD759EEC75488
                                                                                                                                                                                                                                                      SHA-256:BD7DD0C2CAB119A973DC10C3BFF7499D9728B928B541F86056921B30C8DB78E6
                                                                                                                                                                                                                                                      SHA-512:ECD76A7D8B8D733E635B2BFEA90A4CD387B83D9D8A4EB6D299F59FF22AAA8D617A4C886A825A1CDDD901925C7839E2C18BDD4E0CD84152641922B66B62663F77
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:<.d....!..`.......pl....v.....q.t.b.a.s.e._.p.l.....q.t.m.u.l.t.i.m.e.d.i.a._.p.l.....q.t.s.c.r.i.p.t._.p.l... .q.t.x.m.l.p.a.t.t.e.r.n.s._.p.l............,..

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\translations\qt_pt.qm

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):70334
                                                                                                                                                                                                                                                      Entropy (8bit):4.732724622610353
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:768:OKGUuWW+WHjS0gMBd483+Y7bDPs4RHBloLUIltlzAJnx4nnliM1OPlOibLG:JGUuWPuSgm0Jn+n4Mhj
                                                                                                                                                                                                                                                      MD5:6656500F7A28EF820AE9F97FD47FB5BB
                                                                                                                                                                                                                                                      SHA1:CC112B9C9513BCF7497F3417168B4C8A9F7640A9
                                                                                                                                                                                                                                                      SHA-256:2C1E7BBF5168A64B43752DD4C547601C0BDE6D610F8671FA3E3AF38597E84783
                                                                                                                                                                                                                                                      SHA-512:5C3CBFCF86AF6B4D949C1D914CD379E512E73BA350AF661033A386EE7FB981FBFCB43D9A35FDE7656E17BB09F64F1469F84867A780573C3359D645269461D5A6
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:<.d....!..`.......pt_PTB...(...*...9...+...e...]..6....;.......;..-....;..;`...;..};...;.......M..6....O... ...O...w...........}..7....m..7B..........+;......+;..8S..+;..>...+O......+O..8#..H4......H.......J......K.......LD...)..L....}..PS...l..Zr...B..[`...;..[`.....\...kU.._......._.......1...?...............8...............E............,..................p........0...............v...........%...O...%..G........4...0.......0..:....0..y....0..|....0.......0...X...5.......5...... D..=... D..Kn..+....L..,...>...,......<U..z...<U......<.......F...>...F.......H5...4..H5..=...H5..K...H5......f....p..f...1...f...;...f...I...f...|H..f.......f.......l....................b......<...............>.......L ...........`......`..._.......A......2....e...g...e..>D...e..LW................y...,.*.y.....*.y..o..*.y.....*.T..L..*.0..'..*.0....+F...y..+F......+f......+f...C..+.z..0..+.....d.+....p0.+.....R.+.z..0U.+.....u.+....8..+....Ct.+....L..+....y..+.....Z.+......+...pc.+.....+....0..

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\translations\qt_ru.qm

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):164
                                                                                                                                                                                                                                                      Entropy (8bit):3.984562388316898
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:3:j2wZC4C/oZlAlHekF8Op1MUNKJKlI+rwtbWlM4KKIPldkOSxRMugB:CwY+GIUgcIRt61oihM3
                                                                                                                                                                                                                                                      MD5:F7A8C75408B9A34A2B185E76F51B7B85
                                                                                                                                                                                                                                                      SHA1:065E987139C5FB809A6F9CDF3845BCD79707FDBB
                                                                                                                                                                                                                                                      SHA-256:6492B267608C6FB76907BD8FCFC8F1EF57E9F4EBBC2E81ACA81715A88388F94A
                                                                                                                                                                                                                                                      SHA-512:E768C5B438EC899801B22B1325F2244ACCC5E7C2EC5D270F510BC3CBC2D9A0536949C026DB7FB5862835E506A9F2020DEB2CC4001E7011FF974324542734F855
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:<.d....!..`.......ru....v.....q.t.b.a.s.e._.r.u.....q.t.s.c.r.i.p.t._.r.u.....q.t.m.u.l.t.i.m.e.d.i.a._.r.u... .q.t.x.m.l.p.a.t.t.e.r.n.s._.r.u........)......,..

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\translations\qt_sk.qm

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):157
                                                                                                                                                                                                                                                      Entropy (8bit):3.7731953311404336
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:3:j2wZC4C/3xRlAlHekE8lgp1MUM8lMlI+rwtbWlM5UllyIPldkOfll6kchn:CwS0+t8CIUM86IRt6KUlsoi2CVh
                                                                                                                                                                                                                                                      MD5:24C179481B5EF574F33E983A62A34D53
                                                                                                                                                                                                                                                      SHA1:0A67F1ED8CA4A5182F504806F8D47D499789F2D2
                                                                                                                                                                                                                                                      SHA-256:B6ADFFD889FF96BF195CB997327E7D7005A815CAD67823FA6915A19C2D9BB668
                                                                                                                                                                                                                                                      SHA-512:4757F3693120DAB2FBB7BCF1734EA20B3E3D9056B4B4E934A3129D660CFDC6C58B230459DB55912AF24AD5692BD221830BE0FF91E41D3EECD9439E79AC23FFE6
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:<.d....!..`.......sk....v.....q.t.b.a.s.e._.s.k.....q.t.s.c.r.i.p.t._.s.k.....q.t.m.u.l.t.i.m.e.d.i.a._.s.k... .q.t.x.m.l.p.a.t.t.e.r.n.s._.s.k...........

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\translations\qt_sl.qm

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):228428
                                                                                                                                                                                                                                                      Entropy (8bit):4.726953418955661
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:3072:9zQH0hOtgmiAZu0eeAEv+v49JnnSmICgr3n7jhCQUeinqyU5UggtRLGrQ2LZO+Y1:RpUsSpGr36wsR
                                                                                                                                                                                                                                                      MD5:D35A0FE35476BE8BD149CEE46E42B5E9
                                                                                                                                                                                                                                                      SHA1:9F3C85C115A283E5230D1EEAD84C8CB73A71FA03
                                                                                                                                                                                                                                                      SHA-256:C44E0313A9414CC0E490B65B0C036FA11BCA959353B228886547BC2C8492034F
                                                                                                                                                                                                                                                      SHA-512:BEEB1751882AF081E80BE93F7464D4C6322B724EFA2CBD3E1CBE709181D380C1C57E770FA962BB706D6FCF4A8CB393E3F6E187C1F604F8CEEFB201CA3200BD1C
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:<.d....!..`.......slB..<....*.......+.......@...C...A.......B...<...C.......D...2...E.......F...d...G.......H...W...I.......P.......Q.......R.......S...x...T.......U...n...V...%...W.......X.......Y.......]..g~...t...V.......f..................................;..G....;..[....;...q...;..ia...;... ...M..g....O.......O.......[..,e...........}..g....m..h........Q..(5......+;..2...+;...b..+;...i..+O..2...+O...4..1......E@......F.......H4......HY...%..H.......I.......I@......IA...9..IC......J...6...J.......J.......J...^...K...7...LD......L....n..PS...U..R.......T....=..Zr......[`...V..[`......\...!,..\...8U.._..."b.._.../h..1.......E...9......4...............5........e...................$...<...$..Z....[.......,.......y...L...y..].......H.......@.......J.......6........~..........E...O...E..+....E...~..............,1...%..8r...%...........^..............................5.......0..Gx...0.......0..P....0..h....0.......0.......5...^.......... D...... D......+....`..,.......,...-...<U

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\translations\qt_sv.qm

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):65851
                                                                                                                                                                                                                                                      Entropy (8bit):4.7906769989650515
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:1536:4u6DkpgyKmRmG15mGM6iFPi6Q/qTlOQZY2dKN8gKw:4u6DotUG1sGMZPi6Q/qTlO2Y2YKw
                                                                                                                                                                                                                                                      MD5:0E85E0E0E7DDFE3D4BDE302F27047F9C
                                                                                                                                                                                                                                                      SHA1:AE59348E0C2E4F86F99DA6CF5DAB3B7E92504B7C
                                                                                                                                                                                                                                                      SHA-256:4B4B6FF7FD237C9DA0301B4946132E68653D15EB5FAF38E4C5FBFEBB12DD97F7
                                                                                                                                                                                                                                                      SHA-512:8CAAB6C61E9FA26A3A289A9E4DC515D157B3092D6D4ED43861220261BD2B7CC79B35B52F9ADE4EF558B5385B37EAC14575420DD55C475F435BB95B6C1E2561B6
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:<.d....!..`...B.......*.......+...i...]..6....;.......;..-f...;..:;...;..t....;.......M..64...O.......O...........q...}..6\...m..6........(..+;......+;..7...+;..=...+O......+O..7c..H4......H.......J.......K....F..LD...+..L.......PS...N..Zr......[`...7..[`...N..\...h4.._....J.._....k..1...>...............7........}......D............,...........*......i....................................%.......%..Fc.......6...0.......0..9....0..q....0..t....0.......0.......5.......5...... D..<}.. D..I...+.......,...=X..,.......<U..r...<U...n..<.......F...=...F....F..H5......H5..<...H5..J4..H5......f.......f...1V..f...:f..f...H;..f...t&..f.......f.......l..................8......;z..............<.......Je.......6...`...&...`...!.......9......1....e.......e..=....e..J..............g...y.....*.y.../.*.y..h..*.y.....*.T..J..*.0..'[.*.0...K.+F...q..+F.....+f......+f...A..+.z../..+.......+....i`.+.....X.+.z../..+.....S.+....7..+....Bi.+....K..+....q..+.......+......+...i..+.....+....0..F0i.....G.

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\translations\qt_tr.qm

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):110
                                                                                                                                                                                                                                                      Entropy (8bit):3.630483009136986
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:3:j2wZC4C/7zl9lAlHekDN/01MULV4LlI+rwtbWlM+N:Cw5+wUGRIRt6n
                                                                                                                                                                                                                                                      MD5:16CDF5B9D48B0F795D532A0D07F5C3A0
                                                                                                                                                                                                                                                      SHA1:6E403C9096B3051973E2B681DFEBBC8DD024830D
                                                                                                                                                                                                                                                      SHA-256:F574A2CFD4715885C3DBDF5AE60995252673BD94FDAA9586F7E0586F6C1AC0EE
                                                                                                                                                                                                                                                      SHA-512:36A0431368010157EA8A45DCB00458076CCFFC08B37E443DEBD1AAD4A30C6080803337725A7A3DCBF2B410DC7BE89CEAF6C07C46F876E4EF5B08159E3BF38E6D
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:<.d....!..`.......tr....R.....q.t.b.a.s.e._.t.r.....q.t.s.c.r.i.p.t._.t.r.....q.t.m.u.l.t.i.m.e.d.i.a._.t.r

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\translations\qt_uk.qm

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):164
                                                                                                                                                                                                                                                      Entropy (8bit):4.021402900389864
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:3:j2wZC4C/ZlRlAlHekCczOp1MUKUt7KlI+rwtbWlM/cFKIPldkONRMugB:CwUl0+rjIUKUcIRt6M/oioM3
                                                                                                                                                                                                                                                      MD5:9B101363343847FE42167183320C03F0
                                                                                                                                                                                                                                                      SHA1:F0DF2CFF913E588B7CADFDABBF69F4F632B2F96A
                                                                                                                                                                                                                                                      SHA-256:F1621E680E1642F9463E4B07E7E78B50F9A7BDB7C321D7302039CB3405CBDEA4
                                                                                                                                                                                                                                                      SHA-512:DA14FDF8DB514902733CAAC492293873351C595EBBE0ACB0849BECE24AB822602EE64D01051F1426CD1FC13A95D8607302CF9B515D9806FDD3BD047087DE447C
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:<.d....!..`.......uk....v.....q.t.b.a.s.e._.u.k.....q.t.s.c.r.i.p.t._.u.k.....q.t.m.u.l.t.i.m.e.d.i.a._.u.k... .q.t.x.m.l.p.a.t.t.e.r.n.s._.u.k........)......,..

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\translations\qt_zh_CN.qm

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):117347
                                                                                                                                                                                                                                                      Entropy (8bit):5.8593733369029195
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:1536:51dXW89nqEFu54aekvRzHHSVuf8j2+/xc3lhnbsfdAoz/w:v9qEFeLekvRznSVHJG3lhn+djY
                                                                                                                                                                                                                                                      MD5:0D02F0DE5A12BCB338B7042DFBDAACF3
                                                                                                                                                                                                                                                      SHA1:B7C10D249D8986AD8C6939B370407D07227A39F5
                                                                                                                                                                                                                                                      SHA-256:28CDE75D7B32C81FEF1D4630C37B79A61DEC24B357632FF00D6365A57D8BE43B
                                                                                                                                                                                                                                                      SHA-512:21F02EBA36B4411921EA3C70310B8E454E8FC2B8F09957FD6A63B71689DC381F7A5E2C3BDF2810734D659AB43D8A7BD46EF6436ECC52F75C71B5F5C313365444
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:<.d....!..`.......zhB..+....*.......+.......@.......A...8...B.......C.......D.......E...V...F.......G...L...H.......I...9...P.......Q...e...R...^...S.......T...T...U.......V...|...W.......X...o...Y.......]..4 ...;...2...;..,....;..8....;.......;.......M..4H...O.......O...........#...}..4p...m..4........N..(5......+;...f..+;..6Y..+;..<...+O...8..+O..6'..1......E@......F....Y..H4..."..HY..J...H.......I.......J.......J.......K....5..LD..._..L......PS...V..Q....6..R...N...W..../..Zr.....[`.....[`......\...lU.._......._....L..1...<........j......6...............B........I...$..K....$.......,...g...y...3.......A......r...........................9..L7......;w...E..5b...E...G.......5...%.......%..D........`......*........................0.......0..8W...0..}y...0...6...0.......0.......5.......5...... D..:... D..J...+....R..,...;...,......<U..~...<U......<......F...;...F......H5...i..H5..:...H5..Jk..H5...w..VE...[..f....u..f...0X..f...9...f...E...f.......f.......f....j..g....A..l.

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\translations\qt_zh_TW.qm

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):141
                                                                                                                                                                                                                                                      Entropy (8bit):3.7198292994386235
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:3:j2wZC4C/0N6xg/Rl/gl+kNXDelHrwtbWlMwTolIPldkOfDn:CwOO2+g6Mt63oloiUn
                                                                                                                                                                                                                                                      MD5:ED4135D705AEF3D97F8BF6B8FF11F09C
                                                                                                                                                                                                                                                      SHA1:308E2B8F74B863A61AD0B68F4A18ED06965EBEAA
                                                                                                                                                                                                                                                      SHA-256:751ECDA0C33E061D91241268357FBD2F6B7F70A1116E714F28D22EFD61EC7A1A
                                                                                                                                                                                                                                                      SHA-512:B6E6D00553A9C427130129B9D30E862028E549F372A832F0F05747C8E2A79E443F4932EC3AE177537C8BA00D26B5B6CB97D5B35426AB5229F6A468CA485BE0B1
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:<.d....!..`.......zh_TW....n.....q.t.b.a.s.e._.z.h._.T.W...$.q.t.m.u.l.t.i.m.e.d.i.a._.z.h._.T.W...&.q.t.x.m.l.p.a.t.t.e.r.n.s._.z.h._.T.W

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\translations\qtbase_ar.qm

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):160017
                                                                                                                                                                                                                                                      Entropy (8bit):5.35627970915292
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:1536:XGlAMfkX1M0RdaCkR8lfv8vtc8EFrVYA2I4AJZWEWgHg1C8COvzHKHC6Jp9NV0V7:XUr0RACkIwDEpV1Lgf1ubtw3Bb
                                                                                                                                                                                                                                                      MD5:A7E4D0BA0FC5DF07F62CC66EC9878979
                                                                                                                                                                                                                                                      SHA1:21FD131B23BDD1BBA7BBB86F3ED5C83876F45638
                                                                                                                                                                                                                                                      SHA-256:E03FE68D83201543698FD7FE267DD5DFC5BFD195147E74FF2F19AC3491401263
                                                                                                                                                                                                                                                      SHA-512:D9E6B10506FCF20B5B783F011908083D9DF6C5DF88E21B10D07F53A01AD6506A4B921C85335A25BAE54E27BAD7D01B6E240D58FDEEAABC7FF32014EC120C2ECF
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:<.d....!..`.......arB..2....*.......+.......@.......A.......B..._...C......D.......E......F.......G... ...H...D...I...h...P...C...Q...g...R......S.......T.......U.......V...x...W......X.......Y.......]..'=...s......t...........]...........;..'....;..(....;.......;.......M..'e...O.......O...9...........}..'........C...=......m..'....t..........!o..(5...Z..+;..5u..+;..c...+O......1...!...D@...8..E@.....H4...,..HY..QI..H.......IC......J....1..J.......J.......LD......L.......PS......QR...R..R...V2..T.......U....]..X.......Zr.....[`......\....t..]x......_......._.......yg......1...6....E..8V..............C............................$..RN...[...0...,.......y.......y...................K...........9..R....E.."............z.......................%..F;...D...[..................................!....5.......0...I...0.......0...5...0..#....5.......5...p..............W}.. D..(... D..P=..+.......<U......<U......<.......H5..(...H5..P...L.......VE......VE......V....B..f...JJ..f.......f.

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\translations\qtbase_bg.qm

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):165337
                                                                                                                                                                                                                                                      Entropy (8bit):5.332219158085151
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:1536:9ULiyUxPoT6qx+J7FJlaaMJnxjqxq+0Uiff0mbVeb7wiEwYuYqDKBkKHMXHCIMll:9ULpIVFnpwUiEujw27ncUQUz
                                                                                                                                                                                                                                                      MD5:660413AD666A6B31A1ACF8F216781D6E
                                                                                                                                                                                                                                                      SHA1:654409CDF3F551555957D3DBCF8D6A0D8F03A6C5
                                                                                                                                                                                                                                                      SHA-256:E448AC9E3F16C29EB27AF3012EFE21052DAA78FABFB34CD6DFF2F69EE3BD3CDB
                                                                                                                                                                                                                                                      SHA-512:C6AE4B784C3D302D7EC6B9CE7B27DDAF00713ADF233F1246CD0475697A59C84D6A86BAA1005283B1F89FCC0835FD131E5CF07B3534B66A0A0AA6AC6356006B8F
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:<.d....!..`.......bg_BGB../....*..,....+..."...@...]...A.......B.......C.......D...P...E...!...F.......G.......H.......I.......P.......Q.......R...A...S...e...T.......U.......V.......W...1...X...U...Y...y...]..,....s...,...t...................P...;..+....;..-E...;..!....;..+....M..,Y...O...,...O...........*...}..,............=...Q...m..,....t...|......>...(5..1...+;..<...+;..o...+O...r..1...>...D@......E@......H4......HY..[...H.......IC......J....E..J....X..J.......LD......L....L..PS......QR.."...R...`...T....X..U.......X.......Zr...q..[`...`..\.......]x......_......._....T..yg.....1...=....E..?...............L(.......(...............'...$..\....[.......,...I...y...!...y...................S...........9..]%...E..5p...........z..!q...................%..O....D..................D.....8......:......?....5...&...0.......0.. ....0...c...0..5....5.......5..................b:.. D..-... D..Z...+.......<U......<U...0..<.......H5..-...H5..[...L.......VE..#a..VE..;...V.......f...T...f...!..

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\translations\qtbase_ca.qm

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):210159
                                                                                                                                                                                                                                                      Entropy (8bit):4.666388181115542
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:3072:P/DVhdlafzvZfeW+6kXEVjSVPzC3ceKdP2:xYf7UW+WjwP2
                                                                                                                                                                                                                                                      MD5:B383F6D4B9EEA51C065E73ECB95BBD23
                                                                                                                                                                                                                                                      SHA1:DD6C2C4B4888B0D14CEBFC86F471D0FC9B07FE42
                                                                                                                                                                                                                                                      SHA-256:52E94FCC9490889B55812C5433D009B44BDC2DC3170EB55B1AF444EF4AAE1D7F
                                                                                                                                                                                                                                                      SHA-512:9401940A170E22CE6515E3C1453C563D93869A3C3686C859491A1F8795520B61BF3F0BFE4687A7380C0CC0C75E25559354FDB5CEF916AF4C5B6CD9661464A54A
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:<.d....!..`.......caB..7....*.......+.../...@..:P...A..:t...B..:....C..:....D..;=...E..<....F..<Z...G..<~...H..<....I..<....P..>....Q..>....R..?....S..?R...T..?v...U..?....V..?....W..@....X..@<...Y..@`...]../....s..1....t..........2s......#p...;.......;../....;..W....;..e+...M../3...O.......O..9.......J....}../]......8....=..9....m../....t..9Y.......S..(5..lB..+;.._...+;...=..+O..U...1.......D@..:...E@..?...H4...J..HY..~...H..."...IC...0..J....W..J....0..J.......LD..!...L...!f..PS..)...QR.."...R.......T...9~..U...9...U...z...X...>...Zr..E...[`...e..\...LD..]x..7U.._......._...M...yg..f...1...a....E..c....7.........U.......p........b.......4.......K...$.......[.......,.......y.......y...................^...........9...:...E...s...... (...z..":.......d......!....%..tQ...D.."......."......2......ve.....y...........5..#H...0...\...0..W+...0..';...0.......5..(....5..........)s.......... D..0w.. D..}...+...1...<?..5x..<U......<U..5...<...6@..H5..0...H5..~...L...9...VE..$...V...SV..f.

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\translations\qtbase_cs.qm

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):174701
                                                                                                                                                                                                                                                      Entropy (8bit):4.87192387061682
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:3072:5WjuhX0CVRaakGjW9E8SSOQfX/JlwVOMxrboRPqWxXfQvO7zjBf:5iFGj1QfXr8Gd
                                                                                                                                                                                                                                                      MD5:C57D0DE9D8458A5BEB2114E47B0FDE47
                                                                                                                                                                                                                                                      SHA1:3A0E777539C51BB65EE76B8E1D8DCE4386CBC886
                                                                                                                                                                                                                                                      SHA-256:03028B42DF5479270371E4C3BDC7DF2F56CBBE6DDA956A2864AC6F6415861FE8
                                                                                                                                                                                                                                                      SHA-512:F7970C132064407752C3D42705376FE04FACAFD2CFE1021E615182555F7BA82E7970EDF5D14359F9D5CA69D4D570AA9DDC46D48CE787CFF13D305341A3E4AF79
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:<.d....!..`.......cs_CZB..3p...*..F....+.......@..!....@..Ef...A..!....A..E....B.."1...B..E....C.."U...C..E....D.."....D..F....E..#p...E..F)...F..#....F..FP...G..#....G..Fw...H..$....H..F....I..$6...I..F....P..&%...P..Gr...Q..&I...Q..G....R..&....R..G....S..&....S..H....T..&....T..H8...U..'....U..H_...V..'Z...V..H....W..'~...W..H....X..'....X..H....Y..'....Y..H....]..,....]..,....s.......t...9...............*...;.......;..+....;..1B...;......;..?x...;..N....;..iY...;..s3...M..,B...M..,....O.......O...w...O..rr...........}..,j...}..-....... 5...=.. ....m..,....m..-8...t.. .......ay..(5..TT..+;...A..+;..B...+;..u...+O......+O..=a..1...a...D@.."...E@..&m..E@..G...F...J...H4...=..HY..`...H.......I...J...IC......J....-..J.......J.......LD......L....(..PS.....QR.."S..R...e...T.... ..U......X.......Zr...g..[`......\......]x......_......._......._...v...yg......1...C....E..E...............=.......Q........................s...$..a....[.......,.......y.......y...y..............G..........

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\translations\qtbase_da.qm

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):181387
                                                                                                                                                                                                                                                      Entropy (8bit):4.755193800761075
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:3072:XzswP2UvZ5aZ9jFTkmq/gnBNW/+PcWrqm2Vliz0DGdaS4KSLZjwTTgwUR0toT:j3m27AjCT
                                                                                                                                                                                                                                                      MD5:859CE522A233AF31ED8D32822DA7755B
                                                                                                                                                                                                                                                      SHA1:70B19B2A6914DA7D629F577F8987553713CD5D3F
                                                                                                                                                                                                                                                      SHA-256:7D1E5CA3310B54D104C19BF2ABD402B38E584E87039A70E153C4A9AF74B25C22
                                                                                                                                                                                                                                                      SHA-512:F9FAA5A19C2FD99CCD03151B7BE5DDA613E9C69678C028CDF678ADB176C23C7DE9EB846CF915BC3CC67ABD5D62D9CD483A5F47A57D5E6BB2F2053563D62E1EF5
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:<.d....!..`.......daB..4....*..h....+......@...f...A.......B.......C.......D...U...E.......F...v...G.......H.......I.......P.......Q.......R...6...S...Z...T...~...U.......V.......W..."...X...F...Y...j...]..+....s.......t..................-...;..+....;..,....;../....;..;....M..+....O.......O...r...........}..,............=...8...m..,0...t...c......T...(5..B...+;..NH..+;..~H..+O..,...1...UP..D@......E@......H4...E..HY..j...H.......IC...#..J....J..J.......J.......LD......L....1..PS...B..QR......R...o...T.......U.......X.......Zr......[`...W..\....}..]x...[.._....-.._.......yg...e..1...O....E..R....7..........-!......]............................$..k....[...7...,.......y...c...y.................j4...........9..l8...E..p............z...;..................%..a....D...~.............-.....L......OH.....Uz...5.......0.......0...U...0.......0..p....5...7...5..L$..............p... D..-... D..i...+....@..<U.....<U.....<....S..H5..-2..H5..j$..L....B..VE.. ...VE..P...V...*...f...e...f.

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\translations\qtbase_de.qm

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):220467
                                                                                                                                                                                                                                                      Entropy (8bit):4.626295310482312
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:3072:7w8go8+ph6JVB8XVXYWpSNEeg8+vaD+p4N8DDiEKugwGZulh15ce4M+4NsPYXCZW:88h8Sj286tTiDD
                                                                                                                                                                                                                                                      MD5:40760A3456C9C8ABE6EA90336AF5DA01
                                                                                                                                                                                                                                                      SHA1:B249AA1CBF8C2636CE57EB4932D53492E4CE36AC
                                                                                                                                                                                                                                                      SHA-256:553C046835DB9ADEF15954FA9A576625366BA8BFD16637038C4BCD28E5EBACE1
                                                                                                                                                                                                                                                      SHA-512:068E55F39B5250CC937E4B2BD627873132D201D351B9351BE703CD9B95D3BAFB4BD649CB4DF120A976D7C156DA679758D952CAC5E0523107244E517D323BC0C5
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:<.d....!..`.......de_DEB..7....*.......+..3....@..R....A..R....B..S....C..S@...D..S....E..T]...F..T....G..T....H..T....I..U#...P..W....Q..W6...R..W....S..W....T..W....U..W....V..XG...W..Xk...X..X....Y..X....]..2%...s..J$...t..9R......J.......B....;..1....;..3....;..q....;.......M..2O...O.......O..X@......ia...}..2y......Q....=..Q....m..2....t..Q...........(5......+;..ev..+;......+O..oh..1....4..D@..R...E@..WZ..H4..4...HY...[..H...AY..IC..>o..J...>...J.......J...>6..LD..@A..L...@...PS..I...QR..#...R....h..T...W...U...Xh..U....~..X...]...Zr..e(..[`..)...\...j...]x..O..._....K.._...lI..yg...U..1...f....E..i....7..........o.......wG......6.......6.......8....$...n...[..8....,..9....y.......y..=................3......>....9.......E..."......?_...z..#d.......0......A%...%..z....D..A.......B......KP......2.............^...5..B....0.......0..p....0..F....0...}...5..G....5..........H........... D..3}.. D...O..+...Q...<?..Ti..<U......<U..T...<...U)..H5..3...H5......L...X...VE..%j..V...l..

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\translations\qtbase_en.qm

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):16
                                                                                                                                                                                                                                                      Entropy (8bit):4.0
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:3:j2wZC4n:CwZ
                                                                                                                                                                                                                                                      MD5:BCEBCF42735C6849BDECBB77451021DD
                                                                                                                                                                                                                                                      SHA1:4884FD9AF6890647B7AF1AEFA57F38CCA49AD899
                                                                                                                                                                                                                                                      SHA-256:9959B510B15D18937848AD13007E30459D2E993C67E564BADBFC18F935695C85
                                                                                                                                                                                                                                                      SHA-512:F951B511FFB1A6B94B1BCAE9DF26B41B2FF829560583D7C83E70279D1B5304BDE299B3679D863CAD6BB79D0BEDA524FC195B7F054ECF11D2090037526B451B78
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:<.d....!..`...

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\translations\qtbase_es.qm

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):165170
                                                                                                                                                                                                                                                      Entropy (8bit):4.679910767547088
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:1536:JVwzuvb+Ta64KQd84arHX5pxiVhA8QlOD/BnFNa8NsvsfFsfcoZtIx6F:JVwSTG4KqVaLX5pEVK7OJFczstgRtIx8
                                                                                                                                                                                                                                                      MD5:C7C58A6D683797BFDD3EF676A37E2A40
                                                                                                                                                                                                                                                      SHA1:809E580CDBF2FFDA10C77F8BE9BAC081978C102B
                                                                                                                                                                                                                                                      SHA-256:4FFDA56BA3BB5414AB0482D1DDE64A6F226E3488F6B7F3F11A150E01F53FA4C8
                                                                                                                                                                                                                                                      SHA-512:C5AED1A1AA13B8E794C83739B7FDDEAFD96785655C287993469F39607C8B9B0D2D8D222ECD1C13CF8445E623B195192F64DE373A8FB6FE43743BAF50E153CDA5
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:<.d....!..`.......es_ESB../....*..*,...+...y...@.......A.......B.......C.......D...v...E...=...F.......G.......H.......I.......P.......Q... ...R...k...S.......T.......U.......V...1...W...U...X...y...Y.......]..+....s.......t...................c...;..+....;..,....;...%...;..#....;..-....M..+....O.......O...............}..,............=...]...m..,/...t..........A...(5..3...+;..<...+;..o...+O..!b..1...Ap..D@......E@...D..H4...-..HY..[F..H.......IC...%..J....L..J.......J.......LD......L....O..PS......QR..!...R...`K..T.......U....&..X.......Zr.....[`...h..\......]x...|.._....Y.._....A..yg......1...=....E..?a......!.......K........G...............R...$..\Q...[.......,...z...y.......y..................+............9..\....E..2............z.. ....................%..ON...D........................:......=B.....A....5...7...0.......0......0.."....0...,...0..3....5...}...5...Y..............a... D..-!.. D..Z6..+....0..<U...h..<U......<.......H5..-M..H5..Z...L.......VE.."...VE..>...V......

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\translations\qtbase_fi.qm

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):179941
                                                                                                                                                                                                                                                      Entropy (8bit):4.720938209922096
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:3072:lvdTgO2Yl97ZWnbgTLt/Tf9IlqAeiy5uWkYGM0wNCdRjSK2YUlUs:lvdkA9vh5uWkY0MK2YXs
                                                                                                                                                                                                                                                      MD5:8472CF0BF6C659177AD45AA9E3A3247C
                                                                                                                                                                                                                                                      SHA1:7B5313CDA126BB7863001499FB66FB1B56C255FC
                                                                                                                                                                                                                                                      SHA-256:E47FE13713E184D07FA4495DDE0C589B0E8F562E91574A3558A9363443A4FA72
                                                                                                                                                                                                                                                      SHA-512:DE36A1F033BD7A4D6475681EDC93CC7B0B5DCB6A7051831F2EE6F397C971B843E1C10B66C4FB2EFF2A23DC07433E80FBF7B95E62C5B93E121AB5AD88354D9CB8
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:<.d....!..`.......fiB..38...*..ct...+......@.......A.......B.......C...@...D.......E...]...F.......G.......H.......I...#...P.......Q...6...R.......S.......T.......U.......V...G...W...k...X.......Y.......]..*....s...T...t.......................;..*....;..+....;..&....;..3....M..+!...O.......O...e...........}..+K...........=.......m..+w...t..........J...(5..9...+;..:y..+;..mW..+O..$...1...KY..D@......E@...Z..H4...l..HY..X&..H.......IC......J.......J...."..J......LD.....L.......PS...'..QR.. L..R...]...T.......U.......X.......Zr......[`......\.......]x......_....k.._....>..yg.. /..1...;....E..>....7..{(......%.......J........T.......&.......U...$..Y[...[......,...s...y.......y...a.......}......d...........9..Y....E..k'...........z...........V..........%..M....D...Q.......{......d.....A......E......K....5.......0.......0..&J...0.......0..k....5...*...5..I9.............._:.. D..,O.. D..W...+....9..<U...G..<U...*..<.......H5..,y..H5..W...H5......L....5..VE..!u..VE..E...V..."{..f.

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\translations\qtbase_fr.qm

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):166167
                                                                                                                                                                                                                                                      Entropy (8bit):4.685212271435657
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:1536:CLZ1w8McowCppcPwL5pYFw+G00QsbLckCiWxvq+sjs06oFm:C91wxcowspc4L5pUw+cz39CiQ7tloFm
                                                                                                                                                                                                                                                      MD5:1F41FF5D3A781908A481C07B35998729
                                                                                                                                                                                                                                                      SHA1:ECF3B3156FFE14569ECDF805CF3BE12F29681261
                                                                                                                                                                                                                                                      SHA-256:EDB32A933CEF376A2636634E14E2977CED6284E4AA9A4AC7E2292F9CA54C384A
                                                                                                                                                                                                                                                      SHA-512:A492E8AC88095A38A13549C18C68E1F61C7054AB9362C2B04C65B93E48E4A07941C8DA6950BAE79041094623E0ED330CA975110FDE8248B4D9380B9F729AD891
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:<.d....!..`.......fr_FRB../....*..-....+.......@.......A.......B.......C...?...D.......E...\...F.......G.......H.......I..."...P.......Q...5...R.......S.......T.......U.......V...F...W...j...X.......Y.......]..+....s...=...t.......................;..+....;..,....;.......;..$b...;.......M..,....O.......O...5...........}..,3...........=.......m..,]...t..........A...(5..5j..+;..<T..+;..o...+O.."+..1...B\..D@......E@...Y..H4...8..HY..[{..H.......IC......J.......J.......J.......LD...|..L.......PS...?..QR..!...R...`j..T.......U....[..X.......Zr.....[`...)..\......]x......_....7.._.......yg...i..1...=Q...E..?@......"Y......K............................$..\....[...^...,...'...y.......y...+.......o....../c.......Y...9..\....E..6(...........z..!................j...%..OC...D...+.......[......a.....;......>......B....5.......0.......0...m...0..#....0.......0..6....5.......5..................a... D..-Y.. D..Ze..+....]..<U...;..<U......<.......H5..-...H5..Z...L.......VE.."...VE..?...V......

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\translations\qtbase_gd.qm

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):189580
                                                                                                                                                                                                                                                      Entropy (8bit):4.630160941635514
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:1536:SiaI3C87jhakhR0VGkw7ys7CskUH6y4e6IFB4xyMuhvDnJGhFaCo527arBbm07LZ:S2yGjh17yGqxTXhvQoejJd8FUjVgk
                                                                                                                                                                                                                                                      MD5:EB1FB93B0BE51C2AD78FC7BA2F8B9F42
                                                                                                                                                                                                                                                      SHA1:24F7FF809E2F11C579CD388FEA5A4C552FF8D4D0
                                                                                                                                                                                                                                                      SHA-256:63B439DD44139AA3AED54C2EBE03FA9BC77F22C14ED8FBA8EFF2608445BB233D
                                                                                                                                                                                                                                                      SHA-512:E13770AEF33B6666ED7D54E03EE20CA291D4167D673BA6C61D8E64CDD5F7FFE0A9521B95AF67BE719BF263932ECF16E2B2D0B5F3404F9BCD7879114FCC6FC474
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:<.d....!..`.......gd_GBB..2....*...u...+......@.......A...B...B.......C.......D.. ....E.. ....F..!&...G..!J...H..!n...I..!....P..#m...Q..#....R..#....S..$....T..$$...U..$H...V..$....W..$....X..$....Y..%....]../....s...'...t...................F...;.......;../....;..=V...;..G....M../G...O.......O...k......$....}../o.......i...=.......m../....t..........[...(5..M...+;..@...+;..x...+O..:...1...\7..D@...f..E@..#...H4...p..HY..be..H.......IC......J.......J....R..J.......LD......L.......PS......QR..#l..R...g...T.......U.......X....\..Zr......[`......\...&...]x......_....C.._...'t..yg..?...1...BM...E..D.......;.......R'.......t.......@.......?...$..c....[......,...i...y.......y...Y.......f.......+...........9..c....E...............z.."....................%..U....D..................G.....UB.....W......\]...5.......0.......0..<....0...;...0.......5.......5..ij..............h... D..0... D..aC..+....K..<U.....<U...~..<.......H5..0...H5..a...L....1..VE..$...VE..X...V...8|..f...Z...f...=..

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\translations\qtbase_he.qm

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):138690
                                                                                                                                                                                                                                                      Entropy (8bit):5.515748942553918
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:3072:XSue8Z7T3iJsqBejt/zNHSLzdetY2ZISfC/S:XSueK3w7Ijt8zUtYAISfC/S
                                                                                                                                                                                                                                                      MD5:DEAF87D45EE87794AB2DC821F250A87A
                                                                                                                                                                                                                                                      SHA1:DB39C6BAA443AA9BB208043EF7FB7E3403C12D90
                                                                                                                                                                                                                                                      SHA-256:E1EBCA16AFE8994356F81CA007FBDB9DDF865842010FE908923D873B687CAD3F
                                                                                                                                                                                                                                                      SHA-512:276FCE81249EFFE19E95607C39F9ACB3A4AFA3F90745DA21B737A03FEA956B079BCA958039978223FD03F75AC270EC16E46095D0C6DDA327366C948EC2D05B9C
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:<.d....!..`.......he_ILB../....*......+..Sw...@......A......B.......C.......D...X...E.......F.../...G...O...H...o...I......P.......Q.......R...I...S...i...T......U......V.......W.......X.../...Y...O...]..$....s......t..X:.......4......`Y...;..$....;..%....;.......;...5...;.......M..$....O...6...O..s............}..%-...........=...m...m..%k...t..........^..(5......+;..2...+;..^...+O...N..1.......D@......E@...(..H4..T...HY..L...H..._...IC..\...J...\...J.......J...\j..LD..^...L...^o..PS..fl..QR......R...Q...T...su..U...s...X...x3..Zr..~...[`..L\..\.......]x....._......._....o..yg...(..1...3....E..5C.......z......?V......U.......U.......W....$..M....[..W....,..X....y.......y..\........a..............\@...9..NO...E...?......]s...z...G.......(......^....%..B^...D.._......._.................... ..........5..`/...0.......0...L...0......0..d(...0......5..ek...5..........fB......R... D..&O.. D..K...+...l...<U......<U..p)..<...p...H5..&w..H5..La..L...s...VE......VE......V.....

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\translations\qtbase_hu.qm

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):160494
                                                                                                                                                                                                                                                      Entropy (8bit):4.831791320613137
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:3072:BmOMZadV9n51xXeQvjOiIzz7/Vs9Db3ihuJNvMfWxBNlYzYbTrIkfwb03l24cNKu:HkWa5pg0MahBHDd
                                                                                                                                                                                                                                                      MD5:E9D302A698B9272BDA41D6DE1D8313FB
                                                                                                                                                                                                                                                      SHA1:BBF35C04177CF290B43F7D2533BE44A15D929D02
                                                                                                                                                                                                                                                      SHA-256:C61B67BB9D1E84F0AB0792B6518FE055414A68E44D0C7BC7C862773800FA8299
                                                                                                                                                                                                                                                      SHA-512:12947B306874CF93ABA64BB46FAC48179C2D055E770D41AF32E50FFFB9F0C092F583AFCEA8B53FE9E238EF9370E9FFFBEB581270DFA1A7CB74EBE54D9BFF459F
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:<.d....!..`.......hu_HUB../....*.......+.......@.......A...0...B...{...C.......D.......E.......F.......G...<...H...`...I.......P...s...Q.......R.......S.......T...*...U...N...V.......W.......X.......Y.......]..+y...s.......t.......................;..+Q...;..,U...;.......;.......;..&....M..+....O.......O...U..........}..+............=.......m..+....t..........9c..(5..,...+;..;...+;..m7..+O......1...9...D@...T..E@......H4...v..HY..Y...H.......IC......J.......J.......J.......LD......L.......PS...}..QR..!...R...]...T.......U....{..X.......Zr...=..[`......\....*..]x...-.._......._......yg...M..1...<....E..>...............J........T.......(.......S...$..Z....[.......,...u...y.......y...[...............#...........9..Z....E..#&...........z..!'...................%..Mv...D..._....................32.....5......9....5.......0...h...0...E...0.......0.......0..#....5...Z...5...........G......_2.. D..,... D..W...+....W..<U......<U...B..<.......H5..,...H5..X{..L....)..VE.."...VE..6l..V....*.

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\translations\qtbase_it.qm

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):161172
                                                                                                                                                                                                                                                      Entropy (8bit):4.680034416311688
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:1536:eSfxfdO4BKJb0td5pqCOIUP/PFIM7gxGQ9sRrFM6QJ4m8ihkM:eSfxFO4BKJb0td5pnOrvCqg9mRK4IkM
                                                                                                                                                                                                                                                      MD5:88D040696DE3D068F91E0BF000A9EC3E
                                                                                                                                                                                                                                                      SHA1:F978B265E50D14FDDE9693EC96E99B636997B74D
                                                                                                                                                                                                                                                      SHA-256:7C7DC8B45BF4E41FEC60021AB13D9C7655BE007B8123DB8D7537A119EB64A366
                                                                                                                                                                                                                                                      SHA-512:F042637B61C49C91043D73B113545C383BD8D9766FD4ACC21675B4FF727652D50863E72EA811553CB26DF689F692530184A6CE8FE71F9250B5A55662AFE7D923
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:<.d....!..`.......it_ITB../....*.......+.......@.......A..."...B...m...C.......D.......E.......F.......G...0...H...T...I...x...P...q...Q.......R.......S.......T...(...U...L...V.......W.......X.......Y.......]..+....s...'...t...................^...;..+[...;..,g...;.......;.......;..!B...M..+....O...D...O...........(...}..+........I...=.......m..,....t..........4...(5..'...+;..<...+;..oV..+O......1...5...D@...F..E@......H4...J..HY..Z...H.......IC...L..J....s..J....j..J.......LD......L....f..PS......QR..!...R..._...T.......U....3..X.......Zr......[`...Q..\.......]x......_......._....0..yg...C..1...=....E..?o..............Kf.......h.......8.......I...$..[....[.......,...m...y...9...y...........z.......z...........9..\=...E..$u.......:...z.. k...................%..N....D..................M............0......5/...5...2...0.......0...0...0...A...0...)...0..$....5.......5...J.......a......a... D..,... D..Y...+.......<U......<U......<....v..H5..-...H5..Z...L.......VE.."c..VE..1...V....X.

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\translations\qtbase_ja.qm

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):129911
                                                                                                                                                                                                                                                      Entropy (8bit):5.802855391832282
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:1536:W8YYSCjKBJ26c1Z7f25pVmuLXpxfqt7FEUWNrfQje9kWI23pKXvx:xYuKBJ01Z7u5pQuLbESUWNzAAI23pKfx
                                                                                                                                                                                                                                                      MD5:608B80932119D86503CDDCB1CA7F98BA
                                                                                                                                                                                                                                                      SHA1:7F440399ABA23120F40F6F4FCAE966D621A1CC67
                                                                                                                                                                                                                                                      SHA-256:CBA382ACC44D3680D400F2C625DE93D0C4BD72A90102769EDFD1FE91CB9B617B
                                                                                                                                                                                                                                                      SHA-512:424618011A7C06748AADFC2295109D2D916289C81B01C669DA4991499B207B781604A03259C546739A3A6CF2F8F6DFA753B23406B2E2812F5407AEE343B5CBDD
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:<.d....!..`.......jaB../....*...'...+..=....@.......A.......B...?...C...c...D......E......F.......G.......H..."...I...F...P.......Q...'...R...r...S......T......U.......V...8...W...\...X......Y......].."k...s...Q...t..A...............I....;.."C...;..#A...;.......;.......;.......M.."....O...B...O..[?......h....}.."........m...=.......m.."....t...........M..(5......+;......+;..WU..+O......1.......D@......E@...K..H4..>=..HY..F...H...Hr..IC..E...J...F...J.......J...E...LD..Gz..L...G...PS..O...QR......R...K!..T...Z...U...[e..X..._f..Zr..e...[`..7...\...i...]x...'.._......._...j...yg..~+..1.../....E..1?.......#......:.......?.......?n......A....$..G....[..Ap...,..B....y.......y..Ew......|...............E....9..H....E..........F....z...]..............HL...%..=R...D..H.......I!......[......J......M..........5..It...0...3...0.......0...C...0..M....0...a...5..N....5..........N.......L6.. D..#... D..E...+...U%..<U......<U..X ..<...X...H5..#...H5..FK..L...[...VE......VE......V......f.

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\translations\qtbase_ko.qm

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):156799
                                                                                                                                                                                                                                                      Entropy (8bit):5.859529082176036
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:1536:rvTy18hhPekHs1iNXVExWbStnn8TExgkYOvYejZOvXx4Mmf0MwUL8smk/pDZyy:y18hJ61nMStnn8TOgknQRLWZmkxNyy
                                                                                                                                                                                                                                                      MD5:082E361CBAC2E3A0849F87B76EF6E121
                                                                                                                                                                                                                                                      SHA1:F10E882762DCD2E60041BDD6CC57598FC3DF4343
                                                                                                                                                                                                                                                      SHA-256:0179ED1B136E1CB3F583351EAA2C545BA3D83A6EE3F82C32505926A1A5F5F183
                                                                                                                                                                                                                                                      SHA-512:F378A42116924E30FA0B8FFF1D3C3CB185DC35B2746DCE2818BE7C2AA95C5DE103DF44AAC74DA969C36C557F1D4DE42AC7647EC41066247F8AD2697BDED667EA
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:<.d....!..`.......koB..7....*.......+.......@...K...A...o...B......C.......D...8...E.......F...U...G...y...H......I.......P......Q.......R.......S...C...T...g...U.......V.......W.......X...-...Y...Q...]..$....s...>...t...................y...;..${...;..%....;...u...;...l...M..$....O.......O...8...........}..$............=...C...m..%!...t...n..........(5...a..+;..E@..+;..l|..+O......1.......D@.....E@......H4......HY..\...H....]..IC......J.......J....8..J.......LD...a..L.......PS......QR......R...`...T.......U....^..U.......X....y..Zr......[`..y...\....A..]x......_......._....o..yg......1...FJ...E..HE...7..................Q........a.......5...........$..]....[...;...,.......y.......y...V...............!.......|...9..]....E...R...........z...4.......f.......5...%..Te...D..................D......^.............*...5...S...0.......0.......0.......0.......5.......5...........n......a... D..%... D..[...+.......<?......<U...;..<U...+..<.......H5..&...H5..\...L.......VE......V....A..f.

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\translations\qtbase_lv.qm

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):153608
                                                                                                                                                                                                                                                      Entropy (8bit):4.843805801051326
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:3072:y5pmbKIhooMbGe91MrjOhmGzP6LJbWz5XIxELpU6:yObeqrjPGzeJyJLy6
                                                                                                                                                                                                                                                      MD5:BD8BDC7BBDB7A80C56DCB61B1108961D
                                                                                                                                                                                                                                                      SHA1:9538C4D8BB9A95C0D9DC57C7708A99DD53A32D1F
                                                                                                                                                                                                                                                      SHA-256:846E047573AE40C83671C3BA7F73E27EFC24B98C82701DA0DF9973E574178BB2
                                                                                                                                                                                                                                                      SHA-512:F040EC410EBFEA21145F944E71ADCAE8E5F60907D1D3716A937A9A59A48F70C6B7EAAC91C2C554F59357A7BC820CDBD17C73A4DECC20B51F68EB79EDD35C5554
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:<.d....!..`.......lv_LVB.......*...B...+..y....@.......A...=...B......C......D.......E.......F...#...G...G...H...k...I.......P...~...Q......R.......S.......T...5...U...Y...V......W.......X.......Y.......]..%....s.......t...8.......n.......A...;..&....;.......;...!...;...A...;../....M..%....O.......O...............}..%...........=.......m..&....t...(......(g..(5...+..+;..4...+;..d...+O......1...(...D@...a..E@......H4..z...HY..Q...H.......IC......J....6..J.......J.......LD......L....9..PS......QR......R...U...T....S..U.......X...._..Zr......[`..r...\.......]x...*.._......._....{..yg......1...5v...E..7........(......B.......|.......|W......~r...$..R....[..~....,.......y...l...y...............................9..S....E...g...........z...z...................%..F....D........................"Z.....$......)....5.......0...\...0.......0...r...0.......0.......5...a...5..........J......V... D..&... D..P...+.......<U......<U......<.......H5..'"..H5..P...L....~..VE...R..VE..%...V......

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\translations\qtbase_pl.qm

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):162982
                                                                                                                                                                                                                                                      Entropy (8bit):4.841899887077422
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:1536:sXpestp/YIFtDT8FIWYbIJmPYuIpnmxAk6mwyJNqSm9+P:sxpTDT8FIWfJmdCmxApmbnqSm9+P
                                                                                                                                                                                                                                                      MD5:F9475A909A0BAF4B6B7A1937D58293C3
                                                                                                                                                                                                                                                      SHA1:76B97225A11DD1F77CAC6EF144812F91BD8734BD
                                                                                                                                                                                                                                                      SHA-256:CE99032A3B0BF8ABAD758895CC22837088EAD99FD2D2514E2D180693081CFE57
                                                                                                                                                                                                                                                      SHA-512:8A4F1B802B6B81FF25C44251FB4A880E93E9A5FE25E36825A24BFE0EFB34E764E7E1EE585D3A56554964B7921E7813C67F12D200D6E0C5EAF4BB76B064B5C890
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:<.d....!..`.......pl_PLB..0....*.."....+.......@...F...A...j...B......C.......D...3...E.......F...P...G...t...H.......I.......P.......Q.......R.......S...>...T...b...U.......V.......W.......X...(...Y...L...]..*....s.......t...r.......o.......+...;..*....;..+....;..."...;... ...M..*....O...6...O...........a...}..+...........=.......m..+G...t...G......,...(5......+;..:...+;..k...+O......1...-[..D@.....E@......H4...U..HY..WU..H.......IC......J....6..J.......J.......LD......L....%..PS......QR.. ...R...[...T....1..U.......X......Zr......[`......\.......]x...A.._......._....}..yg......1...;W...E..=........%......H....................$..Xp...[.......,.......y...i...y...........}......$R...........9..X....E..+)...........z.. E...................%..K....D...p....................&......(......-....5.......0.......0...e...0.......0..+....5...]...5...........f......]-.. D..,%.. D..V?..+....V..<U......<U......<....-..H5..,M..H5..V...L....Z..VE..!...VE..)...V.......f...P...f....K..f......

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\translations\qtbase_ru.qm

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):203767
                                                                                                                                                                                                                                                      Entropy (8bit):5.362551648909705
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:1536:hn4dEJ63pdhPpy6gu5fs4MHQv6sLlxnrncF423ZL9xyuXwdcX8LZuf76CW+WeXFx:aN3pdV5fZbpItXsttRY+WSq
                                                                                                                                                                                                                                                      MD5:5096AD2743BF89A334FBA6A2964300D4
                                                                                                                                                                                                                                                      SHA1:405F45361A537C7923C240D51B0FF1C46621C203
                                                                                                                                                                                                                                                      SHA-256:3DA6605668F9178D11A838C4515478084DCFB4F9CF22F99D7A92B492DB9C224B
                                                                                                                                                                                                                                                      SHA-512:7B88B501792B5831426BAA669138192ED94CC3F8323A3DF9D5287655DC4D877706908C517AB7523AE8A283BF50B47123F13B8AE40EA2F3081C3459EDC47FC8DD
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:<.d....!..`.......ru_RUB..7....*...L...+...W...@..,....A..,....B..-1...C..-U...D..-....E...r...F.......G.......H../....I../8...P..1'...Q..1K...R..1....S..1....T..1....U..2....V..2\...W..2....X..2....Y..2....].......s..$c...t...'......%........r...;..-....;.......;..J....;..V....M...C...O.......O..&.......8....}...m......+3...=..+....m.......t..+.......p...(5..]@..+;..[0..+;......+O..H...1...qM..D@..-...E@..1o..H4...p..HY..xm..H....*..IC...@..J....g..J.......J.......LD......L....p..PS......QR..!...R...}...T...&...U...'...U...ki..X...+...Zr..3...[`......\...:...]x..)..._......._...;...yg..S...1...\....E..__...7.........H.......k................j.......U...$..y....[.......,.......y...k...y...............................9..y....E...O...........z..!*...................%..nW...D.................%w.....g......j~.....qw...5...H...0.......0..I....0..._...0......5.......5..................~... D../k.. D..wa..+....?..<?.."t..<U......<U.."...<...#z..H5../...H5..w...L...&...VE.."...V...F$.

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\translations\qtbase_sk.qm

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):125763
                                                                                                                                                                                                                                                      Entropy (8bit):4.80343609423322
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:3072:roXDuC1u/2lUBGjJirE5tsd/aev1GIfOdvhw:OucMGjH5tbm
                                                                                                                                                                                                                                                      MD5:3D60E50DCBCBD70EE699BC9B1524FCB9
                                                                                                                                                                                                                                                      SHA1:0211B4911B5B74CC1A46C0FCA87D3BF5632AA44A
                                                                                                                                                                                                                                                      SHA-256:D586AE2C314074CF398417FDECB40709D5478DFEB0A67C2FE60D509EE9B59ED7
                                                                                                                                                                                                                                                      SHA-512:F98211867F1DBCB8A342C00E23FA5718BE6E999F7449CB8470B41BF0F527C7F78CC4D6666E28968F32E96026907156753979BFADA7E6BF4225D02A902D24906D
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:<.d....!..`.......sk_SKB..$x...*.......+..>....@......A......B.......C.......D...3...E...Z...F......G......H.......I.......P.......Q...D...R.......S......T.......U.......V...1...W...X...X.......Y......]...Y...t..D-......K....;...3...;.......;.......;......;...V...M.......O.._ ......l....}.......m...........T..(5...(..+;......+;..%...+O......1......E@...k..F.......H4..?I..HY..@7..H...J...I....,..IC..HT..J...H{..J...H...LD..J"..L...Jv..PS..Q...R...D...Zr..i]..[`..7...\...nB.._...o...1...&....E..(........B......19......A.......A....$..AF...[..C....,..D....y..G.......v........g......G....9..A....E..........IH...%..4.......Kf..............................5..K....0...,...0.......0.......0..Of...0.......5..P....5..........E... D...C.. D..?'..+...Y`..<U......<U..\...<...]...H5...m..H5..?...L...^...VE......f.......f...8...g.......l...aP.......................6......d....D..f(...`..f...............?....`..h5...y..H....5..j........E...e.......e..@....... ......>......oZ......l..

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\translations\qtbase_tr.qm

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):194487
                                                                                                                                                                                                                                                      Entropy (8bit):4.877239354585035
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:3072:yRRhAFCvqDBitD/iDG9AOH+l4TcwZBPqHo9fd9CFRK+2IKAimxsjucV2p0ZqvRu7:yRRHs5mksWVX3lA3
                                                                                                                                                                                                                                                      MD5:6CBC5D8E1EABEC96C281065ECC51E35E
                                                                                                                                                                                                                                                      SHA1:4E1E6BA3772428227CB033747006B4887E5D9AD1
                                                                                                                                                                                                                                                      SHA-256:6A0BF6E70E7920C2B193E76E92F78F315936955D3B06AC039D917F2E06C43281
                                                                                                                                                                                                                                                      SHA-512:CE1F9EE180176153D5F523D71E0DB06F4DEA65C24E5E2CD56341CFAEE349A8E9A0F606D99F7219A35DD4516D1528C90AEA4BB87548A55392B8F2B36164D478B1
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:<.d....!..`.......tr_TRB..7....*.......+...-...@.......A.......B.......C...%...D.......E...F...F.......G.......H.......I.......P.. ....Q.. ....R..!D...S..!h...T..!....U..!....V.."....W.."0...X.."T...Y.."x...]..,g...s.../...t......................;..,9...;..-I...;..9@...;..E....M..,....O.......O...G...........}..,............=...\...m..,....t.........._3..(5..LJ..+;..Wt..+;...\..+O..7...1..._...D@......E@..!...H4...@..HY..t...H....2..IC...r..J......J....D..J....K..LD...$..L....x..PS......QR..!...R...x...T.......U....q..U...Y...X...."..Zr...%..[`......\....:..]x......_......._.......yg..6...1...X....E..[....7...Z......7Q......f............................$..u....[...:...,...5...y.......y...........7...............!...9..u....E...........P...z.. ........p...........%..j....D..................A.....U......Y......_....5...V...0.......0..8....0...U...0.......5.......5..~b..............z+.. D..-... D..s...+.......<?...8..<U...s..<U...p..<.......H5..-...H5..s...L.......VE.."0..V...4..

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\translations\qtbase_uk.qm

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):158274
                                                                                                                                                                                                                                                      Entropy (8bit):5.402056706327934
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:1536:jXwjFVUDdMUD4TzdAhpQgO5poZHvJllEnhmdK4I77/dnPJX/imfb1jhvv3BxT8ue:jBzD4Tzaw5pCvJ8hVPdlvj3p8
                                                                                                                                                                                                                                                      MD5:D6234E4E21021102B021744D5FA22346
                                                                                                                                                                                                                                                      SHA1:63A14327D0CF0941D6D6B58BFA7E8B10337F557B
                                                                                                                                                                                                                                                      SHA-256:51B8FF55B37DC5907D637A8DDDA12FBE816852B0244C74EB4F0FB84867A786E0
                                                                                                                                                                                                                                                      SHA-512:37D24A092C5F29BACB7A4CA8207C4EEFD0F073B7E74A492402867F758084091BF1D79D2BA2B4A28B35FEF42E8023C371FDE97578F74BB2033551154E77102DE6
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:<.d....!..`.......uk_UAB../....*...E...+...l...@.......A.......B...G...C...k...D.......E.......F.......G.......H...*...I...N...P...=...Q...a...R.......S.......T.......U.......V...r...W.......X.......Y.......]..*y...s.......t...........;.......n...;..*Q...;..+U...;.......;...x...;..!(...M..*....O.......O...........6...}..*........E...=.......m..*....t..........3...(5..&...+;..:...+;..k0..+O...A..1...4-..D@... ..E@......H4...8..HY..W...H....2..IC...V..J....}..J.......J....%..LD...&..L....z..PS......QR.. ...R...\...T....(..U.......X.......Zr......[`..~...\.......]x......_......._....4..yg...c..1...;....E..=w.......m......I............................$..X....[...<...,.......y.......y...........M...................9..Y....E...F.......D...z.. ........P...........%..LB...D.......................-n...../......4W...5...F...0...p...0...W...0.......0...k...0.......5.......5..................^... D..+... D..V...+.......<U.../..<U......<....>..H5..+...H5..V...L....S..VE..!...VE..0...V......

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\Qt5\translations\qtbase_zh_TW.qm

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):127849
                                                                                                                                                                                                                                                      Entropy (8bit):5.83455389078597
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:3072:Fv2cHP10gOs6dcFxsJopMqOWv2WIrPFP8pa:Fh6s6iFxEodjef8pa
                                                                                                                                                                                                                                                      MD5:9C6A3721D01ECAF3F952CE96F46CE046
                                                                                                                                                                                                                                                      SHA1:4A944E9E31DF778F7012D8E4A66497583BFD2118
                                                                                                                                                                                                                                                      SHA-256:085D29EAF9BBB788B2F2503D74A1EF963A9411CEB600441254CE49A120E1AB63
                                                                                                                                                                                                                                                      SHA-512:6E2807B8785F42A26C9CCBDBA0327DD40B529B10C468593F0E74113774D1CCDAA4FD9ACE9B259B9040E1475911428ECAEA49425B0F170862CF8147D23DB48E46
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:<.d....!..`.......zh_TWB..2x...*.......+..)....@.......A.......B...j...C......D.......E......F.......G...)...H...M...I...q...P...%...Q...I...R......S......T.......U.......V...Z...W...~...X......Y.......]..!....s.......t..-...............4....;..!z...;.."|...;.......;.......M..!....O.......O..Ay......N)...}..!............=.......m.." ...t...(.........(5......+;..;...+;.._...+O......1.......D@...C..E@...m..H4..*W..HY..Pm..H...3...IC..1...J...1...J.......J...1...LD..2...L...38..PS..6...QR...T..R...T...T...A...U...A...X...E...Zr..K...[`..$...\...OW..]x......_......._...P...yg..a^..1...<....E..>....7...>.......;......Fo......+.......+.......-L...$..QR...[..-....,...F...y.......y..1J...............6......1p...9..Q....E..........2....z...........<......3....%..H....D..4W......4}....................Z...... ...5..4....0...?...0...K...0..5....0...L...5..6....5..........6.......U... D.."... D..O...+...<%..<U......<U..>...<...?:..H5..#...H5..O...L...AS..VE...M..VE......V.......f...L..

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\QtCore.pyd

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):2483712
                                                                                                                                                                                                                                                      Entropy (8bit):6.241719144701645
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:49152:ZYS8YHrNj4/7RsRLvYpiW3pCBU+Z7bJWvCSBYgbxGJ5M2GM/fXR1fUdihfSbCo6e:9bpj4/7RsRLvYpiW3pCBU+Z7bJWvCSBv
                                                                                                                                                                                                                                                      MD5:678FA1496FFDEA3A530FA146DEDCDBCC
                                                                                                                                                                                                                                                      SHA1:C80D8F1DE8AE06ECF5750C83D879D2DCC2D6A4F8
                                                                                                                                                                                                                                                      SHA-256:D6E45FD8C3B3F93F52C4D1B6F9E3EE220454A73F80F65F3D70504BD55415EA37
                                                                                                                                                                                                                                                      SHA-512:8D9E3FA49FB42F844D8DF241786EA9C0F55E546D373FF07E8C89AAC4F3027C62EC1BD0C9C639AFEABC034CC39E424B21DA55A1609C9F95397A66D5F0D834E88E
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........}.........../....td./..../...td./...td./...td./...n../...1../......P...c./....c./....c./...Rich...........................PE..d....p.f.........." ...(.*...........+.......................................0&...........`.............................................L.....................#.$.............%.... t.......................t..(....r..@............@..(o...........................text...~(.......*.................. ..`.rdata..x....@......................@..@.data...h...........................@....pdata..$.....#......n#.............@..@.reloc.......%......L%.............@..B........................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\QtGui.pyd

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):2494976
                                                                                                                                                                                                                                                      Entropy (8bit):6.232020603277999
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:24576:SUjOoTFrwI8nc6EmRAQ9RzgpP2bXYUKuXeLQp5PjYq0zb:SUqCgnZXRAQ9RzggbozJLQp5Mq
                                                                                                                                                                                                                                                      MD5:AE182C36F5839BADDC9DCB71192CFA7A
                                                                                                                                                                                                                                                      SHA1:C9FA448981BA61343C7D7DECACAE300CAD416957
                                                                                                                                                                                                                                                      SHA-256:A9408E3B15FF3030F0E9ACB3429000D253D3BB7206F750091A7130325F6D0D72
                                                                                                                                                                                                                                                      SHA-512:8950244D828C5EDE5C3934CFE2EE229BE19CC00FBF0C4A7CCEBEC19E8641345EF5FD028511C5428E1E21CE5491A3F74FB0175B03DA17588DAEF918E3F66B206A
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......... j..sj..sj..sc..sn..s.p.rh..s1..rh..s.p.ri..s.p.rb..s.p.r...s...rh..s..ro..sj..s...syw.ra..syw.rk..syw.rk..sRichj..s........PE..d....p.f.........." ...(.....................................................P&...........`.........................................`&..L....&................$...............%.....................................p...@...............@{...........................text...O........................... ..`.rdata..............................@..@.data...xz.......^...t..............@....pdata........$.......#.............@..@.reloc........%......^%.............@..B........................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\QtWidgets.pyd

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):5144576
                                                                                                                                                                                                                                                      Entropy (8bit):6.262739223310643
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:49152:Qi+reIG7QwktsFPKoe2yicbbqgkcY9abW7KnTYK2bjMkTDGM7y:uqT7Q1kyTvoWW7EYvM9M
                                                                                                                                                                                                                                                      MD5:E8C3BFBC19378E541F5F569E2023B7AA
                                                                                                                                                                                                                                                      SHA1:ACA007030C1CEE45CBC692ADCB8BCB29665792BA
                                                                                                                                                                                                                                                      SHA-256:A1E97A2AB434C6AE5E56491C60172E59CDCCE42960734E8BDF5D851B79361071
                                                                                                                                                                                                                                                      SHA-512:9134C2EAD00C2D19DEC499E60F91E978858766744965EAD655D2349FF92834AB267AC8026038E576A7E207D3BBD4A87CD5F2E2846A703C7F481A406130530EB0
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................=....1M............1M.....1M.....1M.....+......t.............J......J......J.....Rich...........................PE..d....p.f.........." ...(..,...!.....P.,.......................................N...........`..........................................><.T...D?<...............H..z...........pM..O..Pa8..............................`8.@.............,..............................text.....,.......,................. ..`.rdata........,.......,.............@..@.data... :....A.......A.............@....pdata...z....H..|....H.............@..@.reloc...O...pM..P...0M.............@..B........................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI65242\PyQt5\sip.cp313-win_amd64.pyd

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):120320
                                                                                                                                                                                                                                                      Entropy (8bit):6.034057886020456
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:1536:pPd5NTdYgpmMrZhekwFH4PqgZNBQmT6V6WRFYE9Icx7pz4H5B:NhTdtmMdEkwuFTSvYE9Iczz4H5
                                                                                                                                                                                                                                                      MD5:4F7F9E3A9466F4C0103FB04E1987E098
                                                                                                                                                                                                                                                      SHA1:D4A339702E936AA5ECC1FE906AE2BA3BB0E481D7
                                                                                                                                                                                                                                                      SHA-256:EBF27146466D61411493D2E243EAC691740F9C4B7A4B9AB0D408BE45B5E0AA35
                                                                                                                                                                                                                                                      SHA-512:920BA8D58DCA7946341C1CC01FEA0B76CCE008F1D10061F84455A3DE9BA00FD9534F40C983486211BE92B85F786CD610C386529711A6F573A02BFAF8CA543A19
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........kSR...R...R...[...Z....X..P.......P....X..Q....X..Z....X.._....^..Q...R.......G_..[...G_..S...G_..S...G_..S...RichR...........PE..d.... g.........." ...(.H...........J.......................................0............`.............................................X...h................................ ..........................................@............`...............................text...(G.......H.................. ..`.rdata..lU...`...V...L..............@..@.data.... ..........................@....pdata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI65242\VCRUNTIME140.dll

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):120400
                                                                                                                                                                                                                                                      Entropy (8bit):6.6017475353076716
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:1536:N9TXF5LLXQLlNycKW+D4SdqJk6aN1ACuyxLiyazYaCVoecbdhgOwAd+zfZ1zu:N9jelDoD9uyxLizzFzecbdPwA87S
                                                                                                                                                                                                                                                      MD5:862F820C3251E4CA6FC0AC00E4092239
                                                                                                                                                                                                                                                      SHA1:EF96D84B253041B090C243594F90938E9A487A9A
                                                                                                                                                                                                                                                      SHA-256:36585912E5EAF83BA9FEA0631534F690CCDC2D7BA91537166FE53E56C221E153
                                                                                                                                                                                                                                                      SHA-512:2F8A0F11BCCC3A8CB99637DEEDA0158240DF0885A230F38BB7F21257C659F05646C6B61E993F87E0877F6BA06B347DDD1FC45D5C44BC4E309EF75ED882B82E4E
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......\=..\...\...\..S$...\...$...\...\..5\...\...\.....\.....\.....\.....\......\.....\..Rich.\..........PE..d.....x.........." ...).$...d............................................................`A........................................0u..4...d}..........................PP...........^..p............................\..@............@...............................text............................... ..`fothk........0...................... ..`.rdata...C...@...D...(..............@..@.data................l..............@....pdata...............p..............@..@_RDATA...............|..............@..@.rsrc................~..............@..@.reloc..............................@..B................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI65242\VCRUNTIME140_1.dll

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):49744
                                                                                                                                                                                                                                                      Entropy (8bit):6.701724666218339
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:768:ApzzO6ujT3MbR3v0Cz6SR8q83yaFdWr9zRcmgEl6U9zSC:9q/oGw3fFdwzRcmZFzSC
                                                                                                                                                                                                                                                      MD5:68156F41AE9A04D89BB6625A5CD222D4
                                                                                                                                                                                                                                                      SHA1:3BE29D5C53808186EBA3A024BE377EE6F267C983
                                                                                                                                                                                                                                                      SHA-256:82A2F9AE1E6146AE3CB0F4BC5A62B7227E0384209D9B1AEF86BBCC105912F7CD
                                                                                                                                                                                                                                                      SHA-512:F7BF8AD7CD8B450050310952C56F6A20B378A972C822CCC253EF3D7381B56FFB3CA6CE3323BEA9872674ED1C02017F78AB31E9EB9927FC6B3CBA957C247E5D57
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......?.{...{...{...0...y.......y...r.H.p...{...H.......|.......`.......~.......z.....$.z.......z...Rich{...........PE..d...l0.?.........." ...).<...8.......@...............................................b....`A........................................pm.......m..x....................r..PP......D....c..p...........................`b..@............P..`............................text....;.......<.................. ..`.rdata.."#...P...$...@..............@..@.data................d..............@....pdata...............f..............@..@.rsrc................l..............@..@.reloc..D............p..............@..B................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI65242\_bz2.pyd

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):84240
                                                                                                                                                                                                                                                      Entropy (8bit):6.607563436050078
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:1536:Kdrz7l1EVLsSuvX3dUK4MLgqK7YEog8y5sV8lIJLVy7SyFB:urzcuvXvrEo7y6V8lIJLVyB
                                                                                                                                                                                                                                                      MD5:CB8C06C8FA9E61E4AC5F22EEBF7F1D00
                                                                                                                                                                                                                                                      SHA1:D8E0DFC8127749947B09F17C8848166BAC659F0D
                                                                                                                                                                                                                                                      SHA-256:FC3B481684B926350057E263622A2A5335B149A0498A8D65C4F37E39DD90B640
                                                                                                                                                                                                                                                      SHA-512:E6DA642B7200BFB78F939F7D8148581259BAA9A5EDDA282C621D14BA88083A9B9BD3D17B701E9CDE77AD1133C39BD93FC9D955BB620546BB4FCF45C68F1EC7D6
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......e...!m..!m..!m..(.o.+m..1...#m..1..."m..1...%m..1...)m..1...,m..i..."m..j...#m..!m..|m..i...)m..i... m..i... m..i... m..Rich!m..........PE..d.....g.........." ...).....\......0........................................P......7[....`.............................................H...(........0....... .. ......../...@..........T...........................`...@...............x............................text............................... ..`.rdata...=.......>..................@..@.data...............................@....pdata.. .... ......................@..@.rsrc........0......................@..@.reloc.......@......................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI65242\_ctypes.pyd

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):131344
                                                                                                                                                                                                                                                      Entropy (8bit):6.311142284249784
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:3072:3RF024DWkT/DKGkXY402iXnVJf/FO50XnekZ39gPhvEQZIJyPArm:j0nHT/DKFXZorf/FO50uW3SEQt
                                                                                                                                                                                                                                                      MD5:A55E57D7594303C89B5F7A1D1D6F2B67
                                                                                                                                                                                                                                                      SHA1:904A9304A07716497CF3E4EAAFD82715874C94F1
                                                                                                                                                                                                                                                      SHA-256:F63C6C7E71C342084D8F1A108786CA6975A52CEFEF8BE32CC2589E6E2FE060C8
                                                                                                                                                                                                                                                      SHA-512:FFA61AD2A408A831B5D86B201814256C172E764C9C1DBE0BD81A2E204E9E8117C66F5DFA56BB7D74275D23154C0ED8E10D4AE8A0D0564434E9761D754F1997FC
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........h~..............q...............................................q.......q......!u.............................................Rich....................PE..d.....g.........." ...).............h....................................... .......Z....`.........................................P.................................../...........=..T............................;..@............0...............................text............................... ..`.rdata...y...0...z..................@..@.data....$....... ..................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI65242\_decimal.pyd

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):277776
                                                                                                                                                                                                                                                      Entropy (8bit):6.5855511991551
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:6144:x9iD78EIq4x4OA5bZZ0KDgQcI79qWM53pLW1AFR8E4wXw76TPlpV77777VMvyk:xwDGqr5b8EgQ5+w6k
                                                                                                                                                                                                                                                      MD5:F3377F3DE29579140E2BBAEEFD334D4F
                                                                                                                                                                                                                                                      SHA1:B3076C564DBDFD4CA1B7CC76F36448B0088E2341
                                                                                                                                                                                                                                                      SHA-256:B715D1C18E9A9C1531F21C02003B4C6726742D1A2441A1893BC3D79D7BB50E91
                                                                                                                                                                                                                                                      SHA-512:34D9591590BBA20613691A5287EF329E5927A58127CE399088B4D68A178E3AF67159A8FC55B4FCDCB08AE094753B20DEC2AC3F0B3011481E4ED6F37445CECDD5
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........j2U..\...\...\..s....\..]...\.._...\..X...\..Y...\...]...\..s]...\...].z.\..._...\...Q...\...\...\.......\...^...\.Rich..\.........................PE..d......g.........." ...).....Z...............................................P......W.....`.................................................L........0..........t+......./...@..........T...............................@............... ............................text.............................. ..`.rdata..\...........................@..@.data...8'......."..................@....pdata..t+.......,..................@..@.rsrc........0......................@..@.reloc.......@......................@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI65242\_hashlib.pyd

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):64272
                                                                                                                                                                                                                                                      Entropy (8bit):6.220967684620152
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:768:eNJI0DWiflFwY9X3Th1JnptE462TxNvdbj4dIJvI75YiSyvE62Em:2LDxflFwY9XDhPfVNv+dIJvIF7Syc6c
                                                                                                                                                                                                                                                      MD5:32D76C9ABD65A5D2671AEEDE189BC290
                                                                                                                                                                                                                                                      SHA1:0D4440C9652B92B40BB92C20F3474F14E34F8D62
                                                                                                                                                                                                                                                      SHA-256:838D5C8B7C3212C8429BAF612623ABBBC20A9023EEC41E34E5461B76A285B86C
                                                                                                                                                                                                                                                      SHA-512:49DC391F4E63F4FF7D65D6FD837332745CC114A334FD61A7B6AA6F710B235339964B855422233FAC4510CCB9A6959896EFE880AB24A56261F78B2A0FD5860CD9
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........W.A.6...6...6...N%..6.......6.......6.......6.......6.......6...N...6.......6...6..26.......6.......6....I..6.......6..Rich.6..........PE..d......g.........." ...).P...~.......=..............................................!.....`.........................................p...P................................/......X....l..T............................k..@............`...............................text....N.......P.................. ..`.rdata...M...`...N...T..............@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..X...........................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI65242\_lzma.pyd

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):157968
                                                                                                                                                                                                                                                      Entropy (8bit):6.854644275249963
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:3072:KbbS4R/G4Z8r7NjwJTSUqCRY4By7znfB9mNowgn0lCelIJ012+j:KbR/8oWeBi5YOwflCe8o
                                                                                                                                                                                                                                                      MD5:1BA022D42024A655CF289544AE461FB8
                                                                                                                                                                                                                                                      SHA1:9772A31083223ECF66751FF3851D2E3303A0764C
                                                                                                                                                                                                                                                      SHA-256:D080EABD015A3569813A220FD4EA74DFF34ED2A8519A10473EB37E22B1118A06
                                                                                                                                                                                                                                                      SHA-512:2B888A2D7467E29968C6BB65AF40D4B5E80722FFDDA760AD74C912F3A2F315D402F3C099FDE82F00F41DE6C9FAAEDB23A643337EB8821E594C567506E3464C62
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........7...V.,.V.,.V.,...,.V.,..-.V.,..-.V.,..-.V.,..-.V.,..-.V.,...-.V.,.V.,.V.,..-.V.,..-.V.,..u,.V.,..-.V.,Rich.V.,................PE..d......g.........." ...).`...........1.......................................p.......P....`.............................................L.......x....P.......0.......:.../...`..4....|..T...........................P{..@............p...............................text...^^.......`.................. ..`.rdata.......p.......d..............@..@.data........ ......................@....pdata.......0......................@..@.rsrc........P......................@..@.reloc..4....`.......8..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI65242\_queue.pyd

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):33552
                                                                                                                                                                                                                                                      Entropy (8bit):6.446391764486538
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:384:7GpPCRjqMu/AoS6rf7sif0NHQibZIJ9UoOHQIYiSy1pCQ5xX1rSJIVE8E9VF0Nyf:fkTM6rg9aeZIJ9Uok5YiSyvTo2Et
                                                                                                                                                                                                                                                      MD5:1C03CAA59B5E4A7FB9B998D8C1DA165A
                                                                                                                                                                                                                                                      SHA1:8A318F80A705C64076E22913C2206D9247D30CD7
                                                                                                                                                                                                                                                      SHA-256:B9CF502DADCB124F693BF69ECD7077971E37174104DBDA563022D74961A67E1E
                                                                                                                                                                                                                                                      SHA-512:783ECDA7A155DFC96A718D5A130FB901BBECBED05537434E779135CBA88233DD990D86ECA2F55A852C9BFB975074F7C44D8A3E4558D7C2060F411CE30B6A915F
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........T...........-.........................................................................A...........Rich...................PE..d.....g.........." ...).....:.......................................................r....`.........................................PD..L....D..d....p.......`..l....T.../..........@4..T............................3..@............0...............................text............................... ..`.rdata..2....0....... ..............@..@.data........P.......>..............@....pdata..l....`.......D..............@..@.rsrc........p.......H..............@..@.reloc...............R..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI65242\_socket.pyd

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):83728
                                                                                                                                                                                                                                                      Entropy (8bit):6.331814573029388
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:1536:XuV3gvWHQdMq3ORC/OypTXQlyJ+9+nzEYwsBI6tzOKuZIJywJ7Sy21:XuVQvcQTSypTXQlyJs+nzEYJI6QlZIJY
                                                                                                                                                                                                                                                      MD5:FE896371430BD9551717EF12A3E7E818
                                                                                                                                                                                                                                                      SHA1:E2A7716E9CE840E53E8FC79D50A77F40B353C954
                                                                                                                                                                                                                                                      SHA-256:35246B04C6C7001CA448554246445A845CE116814A29B18B617EA38752E4659B
                                                                                                                                                                                                                                                      SHA-512:67ECD9A07DF0A07EDD010F7E3732F3D829F482D67869D6BCE0C9A61C24C0FDC5FF4F4E4780B9211062A6371945121D8883BA2E9E2CF8EB07B628547312DFE4C9
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............ll}.ll}.ll}...}.ll}..m|.ll}..o|.ll}..h|.ll}..i|.ll}..m|.ll}.lm}.ll}..m|.ll}..a|.ll}..l|.ll}..}.ll}..n|.ll}Rich.ll}........PE..d.....g.........." ...).x.......... -.......................................`.......s....`.........................................@...P............@.......0.........../...P..........T...........................@...@............................................text....w.......x.................. ..`.rdata.. y.......z...|..............@..@.data...............................@....pdata.......0......................@..@.rsrc........@......................@..@.reloc.......P......................@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI65242\_ssl.pyd

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):181520
                                                                                                                                                                                                                                                      Entropy (8bit):5.972827303352998
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:3072:kO+IWyXHllRhN1qhep7fM6CpqjZI8u7pUULbaLZErWreVEzvT3iFCNc6tYwJc1OW:kpSrhN1E2M6CpUuwg5dEW7
                                                                                                                                                                                                                                                      MD5:1C0E3E447F719FBE2601D0683EA566FC
                                                                                                                                                                                                                                                      SHA1:5321AB73B36675B238AB3F798C278195223CD7B1
                                                                                                                                                                                                                                                      SHA-256:63AE2FEFBFBBBC6EA39CDE0A622579D46FF55134BC8C1380289A2976B61F603E
                                                                                                                                                                                                                                                      SHA-512:E1A430DA2A2F6E0A1AED7A76CC4CD2760B3164ABC20BE304C1DB3541119942508E53EA3023A52B8BADA17A6052A7A51A4453EFAD1A888ACB3B196881226C2E5C
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......FM.^.,k..,k..,k..T...,k...j..,k...h..,k...o..,k...n..,k.J.j..,k...j..,k..,j..-k.ITj..,k.J.f..,k.J.k..,k.J....,k.J.i..,k.Rich.,k.................PE..d......g.........." ...)............ /..............................................R\....`.............................................d................................/..............T...........................P...@............................................text...0........................... ..`.rdata..D%.......&..................@..@.data...`...........................@....pdata...............n..............@..@.rsrc................z..............@..@.reloc..............................@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI65242\_wmi.pyd

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):38160
                                                                                                                                                                                                                                                      Entropy (8bit):6.338856805460127
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:768:fEkK9VgWOZbs3550QcJpPllIJLiX5YiSyvQ602Euf0:fE93jkbQcJvlIJLiJ7Syq00
                                                                                                                                                                                                                                                      MD5:1C30CC7DF3BD168D883E93C593890B43
                                                                                                                                                                                                                                                      SHA1:31465425F349DAE4EDAC9D0FEABC23CE83400807
                                                                                                                                                                                                                                                      SHA-256:6435C679A3A3FF4F16708EBC43F7CA62456C110AC1EA94F617D8052C90C143C7
                                                                                                                                                                                                                                                      SHA-512:267A1807298797B190888F769D998357B183526DFCB25A6F1413E64C5DCCF87F51424B7E5D6F2349D7A19381909AB23B138748D8D9F5858F7DC0552F5C5846AC
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........H2.&a.&a.&a..a.&a..'`.&a..%`.&a.."`.&a..'`.&a..#`.&a..'`.&a.'a..&a.."`.&a../`.&a..&`.&a...a.&a..$`.&aRich.&a................PE..d.....g.........." ...).,...<.......)..............................................'.....`.........................................0V..H...xV.......................f.../......x...tG..T............................C..@............@.......T..@....................text....*.......,.................. ..`.rdata..d ...@..."...0..............@..@.data........p.......R..............@....pdata...............V..............@..@.rsrc................Z..............@..@.reloc..x............d..............@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI65242\base_library.zip

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):1394456
                                                                                                                                                                                                                                                      Entropy (8bit):5.531698507573688
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:12288:IW7WpLV6yNLeGQbVz3YQfiBgDPtLwjFx278e6ZQnHS91lqyL+DXUgnxOr+dx5/GO:B7WpLtHa9BHSHAW+dx5/GP05vddD
                                                                                                                                                                                                                                                      MD5:A9CBD0455B46C7D14194D1F18CA8719E
                                                                                                                                                                                                                                                      SHA1:E1B0C30BCCD9583949C247854F617AC8A14CBAC7
                                                                                                                                                                                                                                                      SHA-256:DF6C19637D239BFEDC8CD13D20E0938C65E8FDF340622FF334DB533F2D30FA19
                                                                                                                                                                                                                                                      SHA-512:B92468E71490A8800E51410DF7068DD8099E78C79A95666ECF274A9E9206359F049490B8F60B96081FAFD872EC717E67020364BCFA972F26F0D77A959637E528
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:PK..........!..b.e............_collections_abc.pyc......................................\.....S.r.S.S.K.J.r.J.r. .S.S.K.r.\.".\.\.....5.......r.\.".S.5.......r.S...r.\.".\.5.......r.C./.S.Q.r.S.r.\.".\.".S.5.......5.......r.\.".\.".\.".5.......5.......5.......r.\.".\.".0.R%..................5.......5.......5.......r.\.".\.".0.R)..................5.......5.......5.......r.\.".\.".0.R-..................5.......5.......5.......r.\.".\."./.5.......5.......r.\.".\.".\."./.5.......5.......5.......r.\.".\.".\.".S.5.......5.......5.......r.\.".\.".\.".S.S.-...5.......5.......5.......r.\.".\.".\.".5.......5.......5.......r.\.".\.".S.5.......5.......r \.".\.".S.5.......5.......r!\.".\.".\"".5.......5.......5.......r#\.".0.R%..................5.......5.......r$\.".0.R)..................5.......5.......r%\.".0.R-..................5.......5.......r&\.".\.RN..................5.......r(S...r)\)".5.......r*C)\.".S...".5.......5.......r+S...r,\,".5.......r,\.".\,5.......r-\,R]..................5.......

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI65242\certifi\cacert.pem

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:ASCII text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):299427
                                                                                                                                                                                                                                                      Entropy (8bit):6.047872935262006
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:6144:QW1x/M8fRR1jplkXURrVADwYCuCigT/QRSRqNb7d8iu5Nahx:QWb/TRJLWURrI5RWavdF08/
                                                                                                                                                                                                                                                      MD5:50EA156B773E8803F6C1FE712F746CBA
                                                                                                                                                                                                                                                      SHA1:2C68212E96605210EDDF740291862BDF59398AEF
                                                                                                                                                                                                                                                      SHA-256:94EDEB66E91774FCAE93A05650914E29096259A5C7E871A1F65D461AB5201B47
                                                                                                                                                                                                                                                      SHA-512:01ED2E7177A99E6CB3FBEF815321B6FA036AD14A3F93499F2CB5B0DAE5B713FD2E6955AA05F6BDA11D80E9E0275040005E5B7D616959B28EFC62ABB43A3238F0
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:.# Issuer: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Subject: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Label: "GlobalSign Root CA".# Serial: 4835703278459707669005204.# MD5 Fingerprint: 3e:45:52:15:09:51:92:e1:b7:5d:37:9f:b1:87:29:8a.# SHA1 Fingerprint: b1:bc:96:8b:d4:f4:9d:62:2a:a8:9a:81:f2:15:01:52:a4:1d:82:9c.# SHA256 Fingerprint: eb:d4:10:40:e4:bb:3e:c7:42:c9:e3:81:d3:1e:f2:a4:1a:48:b6:68:5c:96:e7:ce:f3:c1:df:6c:d4:33:1c:99.-----BEGIN CERTIFICATE-----.MIIDdTCCAl2gAwIBAgILBAAAAAABFUtaw5QwDQYJKoZIhvcNAQEFBQAwVzELMAkG.A1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExEDAOBgNVBAsTB1Jv.b3QgQ0ExGzAZBgNVBAMTEkdsb2JhbFNpZ24gUm9vdCBDQTAeFw05ODA5MDExMjAw.MDBaFw0yODAxMjgxMjAwMDBaMFcxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9i.YWxTaWduIG52LXNhMRAwDgYDVQQLEwdSb290IENBMRswGQYDVQQDExJHbG9iYWxT.aWduIFJvb3QgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDaDuaZ.jc6j40+Kfvvxi4Mla+pIH/EqsLmVEQS98GPR4mdmzxzdzxtIK+6NiY6arymAZavp.xy0Sy6scTHAHoT0KMM0VjU/43dSMUBUc71DuxC73/OlS8pF94G3VNTCOXkNz

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI65242\charset_normalizer\md.cp313-win_amd64.pyd

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):10752
                                                                                                                                                                                                                                                      Entropy (8bit):4.818583535960129
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:96:Mvs10hZd9D74ACb0xx2uKynu10YLsgxwJiUNiL0U5IZsJFPGDtCFCCQAADo+cX6m:MXv9XFCk2z1/t12iwU5usJFuCyPcqgE
                                                                                                                                                                                                                                                      MD5:56FE4F6C7E88212161F49E823CCC989A
                                                                                                                                                                                                                                                      SHA1:16D5CBC5F289AD90AEAA4FF7CB828627AC6D4ACF
                                                                                                                                                                                                                                                      SHA-256:002697227449B6D69026D149CFB220AC85D83B13056C8AA6B9DAC3FD3B76CAA4
                                                                                                                                                                                                                                                      SHA-512:7C9D09CF9503F73E6F03D30E54DBB50606A86D09B37302DD72238880C000AE2B64C99027106BA340753691D67EC77B3C6E5004504269508F566BDB5E13615F1E
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........k............r_...........r................................................3..........Rich....................PE..d....$.g.........." ...).....................................................p............`..........................................'..p...`(..d....P.......@...............`..,...`#.............................. "..@............ ...............................text............................... ..`.rdata....... ......................@..@.data........0......."..............@....pdata.......@.......$..............@..@.rsrc........P.......&..............@..@.reloc..,....`.......(..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI65242\charset_normalizer\md__mypyc.cp313-win_amd64.pyd

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):124928
                                                                                                                                                                                                                                                      Entropy (8bit):5.953784637413928
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:3072:JDE+0ov6ojgN3qN8h51Zlh+YW5E38vCsmLS:JdefPZE2ICDLS
                                                                                                                                                                                                                                                      MD5:10116447F9276F10664BA85A5614BA3A
                                                                                                                                                                                                                                                      SHA1:EFD761A3E6D14E897D37AFB0C7317C797F7AE1D6
                                                                                                                                                                                                                                                      SHA-256:C393098E7803ABF08EE8F7381AD7B0F8FAFFBF66319C05D72823308E898F8CFC
                                                                                                                                                                                                                                                      SHA-512:C04461E52B7FE92D108CBDEB879B7A8553DD552D79C88DFA3F5D0036EED8D4B8C839C0BF2563BC0C796F8280ED2828CA84747CB781D2F26B44214FCA2091EAE4
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........y.....................7...............7.......7.......7.......6..........D....6.......6.......6.......6......Rich............................PE..d....$.g.........." ...).@...........C.......................................0............`.........................................0...d.................................... ......................................P...@............P...............................text....?.......@.................. ..`.rdata..nY...P...Z...D..............@..@.data....=.......0..................@....pdata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI65242\libcrypto-3.dll

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):5232408
                                                                                                                                                                                                                                                      Entropy (8bit):5.940072183736028
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:98304:/V+Qs2NuR5YV0L8PQ1CPwDvt3uFlDC4SC9c:9rs2NuDYV0L841CPwDvt3uFlDC4SCa
                                                                                                                                                                                                                                                      MD5:123AD0908C76CCBA4789C084F7A6B8D0
                                                                                                                                                                                                                                                      SHA1:86DE58289C8200ED8C1FC51D5F00E38E32C1AAD5
                                                                                                                                                                                                                                                      SHA-256:4E5D5D20D6D31E72AB341C81E97B89E514326C4C861B48638243BDF0918CFA43
                                                                                                                                                                                                                                                      SHA-512:80FAE0533BA9A2F5FA7806E86F0DB8B6AAB32620DDE33B70A3596938B529F3822856DE75BDDB1B06721F8556EC139D784BC0BB9C8DA0D391DF2C20A80D33CB04
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........._~.._~.._~..V.S.M~.....]~.....[~.....W~.....S~.._~...~......T~..J....~..J...7}..J...^~..J.?.^~..J...^~..Rich_~..........................PE..d......f.........." ...(..7..<......v........................................0P.......O...`...........................................H.0.....O.@....@O.|.... L. .....O../...PO.$...`{D.8............................yD.@.............O..............................text.....7.......7................. ..`.rdata........7.......7.............@..@.data...Ao....K..<....K.............@....pdata....... L.......K.............@..@.idata...%....O..&....N.............@..@.00cfg..u....0O.......N.............@..@.rsrc...|....@O.......N.............@..@.reloc..~....PO.......N.............@..B................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI65242\libffi-8.dll

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):39696
                                                                                                                                                                                                                                                      Entropy (8bit):6.641880464695502
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
                                                                                                                                                                                                                                                      MD5:0F8E4992CA92BAAF54CC0B43AACCCE21
                                                                                                                                                                                                                                                      SHA1:C7300975DF267B1D6ADCBAC0AC93FD7B1AB49BD2
                                                                                                                                                                                                                                                      SHA-256:EFF52743773EB550FCC6CE3EFC37C85724502233B6B002A35496D828BD7B280A
                                                                                                                                                                                                                                                      SHA-512:6E1B223462DC124279BFCA74FD2C66FE18B368FFBCA540C84E82E0F5BCBEA0E10CC243975574FA95ACE437B9D8B03A446ED5EE0C9B1B094147CEFAF704DFE978
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........iV...8...8...8..p....8.t9...8.p9...8...9...8.t=...8.t<...8.t;...8.1t<...8.1t;...8.1t8...8.1t:...8.Rich..8.........................PE..d...Sh.c.........." ...".H...(.......L...............................................n....`......................................... l.......p..P...............P....l.../......,...@d...............................c..@............`.. ............................text....G.......H.................. ..`.rdata..h....`.......L..............@..@.data................b..............@....pdata..P............d..............@..@.reloc..,............j..............@..B................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI65242\libssl-3.dll

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):792856
                                                                                                                                                                                                                                                      Entropy (8bit):5.57949182561317
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:12288:7LN1sdyIzHHZp5c3nlUa6lxzAG11rbmFe9Xbv:7LgfzH5I3nlUa2AU2Fe9Xbv
                                                                                                                                                                                                                                                      MD5:4FF168AAA6A1D68E7957175C8513F3A2
                                                                                                                                                                                                                                                      SHA1:782F886709FEBC8C7CEBCEC4D92C66C4D5DBCF57
                                                                                                                                                                                                                                                      SHA-256:2E4D35B681A172D3298CAF7DC670451BE7A8BA27C26446EFC67470742497A950
                                                                                                                                                                                                                                                      SHA-512:C372B759B8C7817F2CBB78ECCC5A42FA80BDD8D549965BD925A97C3EEBDCE0335FBFEC3995430064DEAD0F4DB68EBB0134EB686A0BE195630C49F84B468113E3
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........l.>..|m..|m..|m.u.m..|m+.}l..|m.u}l..|m+..l..|m+.xl..|m+.yl..|m..}l..|m..}m..|m..xl..|m..|l..|m...m..|m..~l..|mRich..|m................PE..d......f.........." ...(.>..........K........................................0......!+....`..........................................x...Q..............s.... ...M......./......d...p...8...............................@............................................text....<.......>.................. ..`.rdata..hz...P...|...B..............@..@.data...qN.......H..................@....pdata..pV... ...X..................@..@.idata...c.......d...^..............@..@.00cfg..u...........................@..@.rsrc...s...........................@..@.reloc..C...........................@..B........................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI65242\psutil\_psutil_windows.pyd

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):67072
                                                                                                                                                                                                                                                      Entropy (8bit):5.909456553599775
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:1536:j3sHmR02IvVxv7WCyKm7c5Th4JBHTOvyyaZE:jnIvryCyKx5Th4J5OvyyO
                                                                                                                                                                                                                                                      MD5:49AC12A1F10AB93FAFAB064FD0523A63
                                                                                                                                                                                                                                                      SHA1:3AD6923AB0FB5D3DD9D22ED077DB15B42C2FBD4F
                                                                                                                                                                                                                                                      SHA-256:BA033B79E858DBFCBA6BF8FB5AFE10DEFD1CB03957DBBC68E8E62E4DE6DF492D
                                                                                                                                                                                                                                                      SHA-512:1BC0F50E0BB0A9D9DDDAD31390E5C73B0D11C2B0A8C5462065D477E93FF21F7EDC7AA2B2B36E478BE0A797A38F43E3FBEB6AAABEF0BADEC1D8D16EB73DF67255
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......nT..*5..*5..*5..#M2. 5..x@..(5..x@..&5..x@.."5..x@...5...k..(5..aM..;5..*5...5...@..:5...@..+5...@^.+5...@..+5..Rich*5..................PE..d...._.g.........." .........h......\........................................@............`.........................................0...`.......@.... .......................0..(.......................................8............................................text...h........................... ..`.rdata..\I.......J..................@..@.data...x...........................@....pdata..............................@..@.rsrc........ ......................@..@.reloc..(....0......................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI65242\python3.dll

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):70416
                                                                                                                                                                                                                                                      Entropy (8bit):6.1258200129869405
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:768:pQEotsskOv6pWVCB4p/uKlZPRQcFIc9qunV0Jku/YFI1Hu1wEBbCpVNyD6VdPxiD:/otssyKcunV8PjZIJy0i7SyWH1
                                                                                                                                                                                                                                                      MD5:16855EBEF31C5B1EBE767F1C617645B3
                                                                                                                                                                                                                                                      SHA1:315521F3A748ABFA35CD4D48E8DD09D0556D989B
                                                                                                                                                                                                                                                      SHA-256:A5C6A329698490A035133433928D04368CE6285BB91A9D074FC285DE4C9A32A4
                                                                                                                                                                                                                                                      SHA-512:C3957B3BD36B10C7AD6EA1FF3BC7BD65CDCEB3E6B4195A25D0649AA0DA179276CE170DA903D77B50A38FC3D5147A45BE32DBCFDBFBF76CC46301199C529ADEA4
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%?..a^e.a^e.a^e.).m.`^e.).e.`^e.)..`^e.).g.`^e.Richa^e.........PE..d......g.........." ...)............................................................z.....`.........................................`..................................../..............T............................................................................rdata..............................@..@.rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI65242\python313.dll

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):6083856
                                                                                                                                                                                                                                                      Entropy (8bit):6.126922729922386
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:49152:fXGc3O7T4DKX+vLFMmKYxiAYNBD987KdJlI9HbeX2jrgQcw6Zc4h67mM+XDQ3bLi:Of42zJiwJl/YF7v3vaHDMiEN3Kr
                                                                                                                                                                                                                                                      MD5:B9DE917B925DD246B709BB4233777EFD
                                                                                                                                                                                                                                                      SHA1:775F258D8B530C6EA9F0DD3D1D0B61C1948C25D2
                                                                                                                                                                                                                                                      SHA-256:0C0A66505093B6A4BB3475F716BD3D9552095776F6A124709C13B3F9552C7D99
                                                                                                                                                                                                                                                      SHA-512:F4BF3398F50FDD3AB7E3F02C1F940B4C8B5650ED7AF16C626CCD1B934053BA73A35F96DA03B349C1EB614BB23E0BC6B5CC58B07B7553A5C93C6D23124F324A33
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........s]{v ]{v ]{v M.w!_{v M.. S{v M.u!Y{v M.r!U{v M.s!P{v T.. G{v ..w!V{v ]{w .zv ..{!.{v ..v!\{v ... \{v ..t!\{v Rich]{v ........................PE..d......g.........." ...).:+..T9......J........................................d.....uF]...`...........................................O.....h.P.......d......0].......\../....d..... A3.T.....................I.(....?3.@............P+..............................text....8+......:+................. ..`.rdata....%..P+...%..>+.............@..@.data...$9....P..N....P.............@....pdata.......0]...... U.............@..@PyRuntim.N...._..P....W.............@....rsrc.........d.......[.............@..@.reloc........d.......[.............@..B........................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI65242\select.pyd

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):30992
                                                                                                                                                                                                                                                      Entropy (8bit):6.554484610649281
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:384:7hhxm9tKLhuoNHfzzlvFy0ZZIJ9GckHQIYiSy1pCQ4HWSJIVE8E9VF0Ny6sC:tCytHf98uZIJ9Gx5YiSyvy2ES
                                                                                                                                                                                                                                                      MD5:20831703486869B470006941B4D996F2
                                                                                                                                                                                                                                                      SHA1:28851DFD43706542CD3EF1B88B5E2749562DFEE0
                                                                                                                                                                                                                                                      SHA-256:78E5994C29D8851F28B5B12D59D742D876683AEA58ECEEA1FB895B2036CDCDEB
                                                                                                                                                                                                                                                      SHA-512:4AAF5D66D2B73F939B9A91E7EDDFEB2CE2476C625586EF227B312230414C064AA850B02A4028363AA4664408C9510594754530A6D026A0A84BE0168D677C1BC4
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........tV..'V..'V..'_.j'T..'F:.&T..'F:.&R..'F:.&^..'F:.&Z..'.;.&T..'V..'...'...&S..'.;.&W..'.;.&W..'.;.'W..'.;.&W..'RichV..'................PE..d.....g.........." ...).....2............................................................`..........................................@..L...<A..x....p.......`.......J.../......L....3..T............................2..@............0...............................text............................... ..`.rdata.......0......................@..@.data...p....P.......8..............@....pdata.......`.......:..............@..@.rsrc........p.......>..............@..@.reloc..L............H..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI65242\unicodedata.pyd

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):709904
                                                                                                                                                                                                                                                      Entropy (8bit):5.861739047785334
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:12288:FYGdLI/X77mvfldCKGihH32W3cnPSqrUgLIe:FYGW7qNxr3cnPXLIe
                                                                                                                                                                                                                                                      MD5:0902D299A2A487A7B0C2D75862B13640
                                                                                                                                                                                                                                                      SHA1:04BCBD5A11861A03A0D323A8050A677C3A88BE13
                                                                                                                                                                                                                                                      SHA-256:2693C7EE4FBA55DC548F641C0CB94485D0E18596FFEF16541BD43A5104C28B20
                                                                                                                                                                                                                                                      SHA-512:8CBEF5A9F2D24DA1014F8F1CCBDDD997A084A0B04DD56BCB6AC38DDB636D05EF7E4EA7F67A085363AAD3F43D45413914E55BDEF14A662E80BE955E6DFC2FECA3
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Q.............(.....(.....(.....(.....)................).....).....)x....)....Rich..................PE..d.....g.........." ...).B...f......P,..............................................<.....`.........................................P...X................................/..........p...T...........................0...@............`..h............................text....@.......B.................. ..`.rdata...?...`...@...F..............@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Windows\appcompat\Programs\Amcache.hve

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Windows\System32\WerFault.exe
                                                                                                                                                                                                                                                      File Type:MS Windows registry file, NT/2000 or above
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):1835008
                                                                                                                                                                                                                                                      Entropy (8bit):4.465467726947162
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:6144:kIXfpi67eLPU9skLmb0b40WSPKaJG8nAgejZMMhA2gX4WABl0uNbdwBCswSbI:ZXD940WlLZMM6YFHp+I
                                                                                                                                                                                                                                                      MD5:DF03A50FC0FD71912322CB2413ACCE21
                                                                                                                                                                                                                                                      SHA1:570A8BF81BA5D69F0CBA9C62688CAD2C4A136D91
                                                                                                                                                                                                                                                      SHA-256:180C23F1168C456EF47DB11ACC70D31F6637243A038CCCFCF82259F8F07666A9
                                                                                                                                                                                                                                                      SHA-512:018E41EF5F08C45F9CF4C49AFED272F02CE2147880D2C543997C2C23990A6DE5B6CE8EE701590A31E74588A3ABF5E4002005BD423F4ED4A4696BEB0FFB644333
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:regf6...6....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm....R..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      Static File Info

                                                                                                                                                                                                                                                      General

                                                                                                                                                                                                                                                      File type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                      Entropy (8bit):7.995837929088591
                                                                                                                                                                                                                                                      TrID:
                                                                                                                                                                                                                                                      • Win64 Executable GUI (202006/5) 92.65%
                                                                                                                                                                                                                                                      • Win64 Executable (generic) (12005/4) 5.51%
                                                                                                                                                                                                                                                      • Generic Win/DOS Executable (2004/3) 0.92%
                                                                                                                                                                                                                                                      • DOS Executable Generic (2002/1) 0.92%
                                                                                                                                                                                                                                                      • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                                                                                                                                                                                                                      File name:wp-s2.exe
                                                                                                                                                                                                                                                      File size:38'752'565 bytes
                                                                                                                                                                                                                                                      MD5:62370a84134040d803eae9a4bd34342c
                                                                                                                                                                                                                                                      SHA1:207f73ffdcdfa2cb5d713e13385a8c65bb19adf7
                                                                                                                                                                                                                                                      SHA256:e84a1edd3826ccb96eadc6d62410361e7820f3c5bc8b7ba308278f33aa2266e4
                                                                                                                                                                                                                                                      SHA512:163e43dc823bbbba4a7899a2e50c66f75d5ecfd74c95d0ebb81c508a77ad6eb350412bbf93a0ddf94889ea30781afd02f33f0381371394110f3b79ea51b3a10b
                                                                                                                                                                                                                                                      SSDEEP:786432:/+gX4BMdhwzTQXR5FbPp6FcSS5U/LT2KzVyPVLBdebXMb8VH/zEa:BXGMK4XR3bLSCU/+6yPl3ebcBa
                                                                                                                                                                                                                                                      TLSH:F9873300E5D409DEE5B22974F5F1528BD559F0EE4B72C2EB81B0025385B7BC09B2EA7B
                                                                                                                                                                                                                                                      File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......n=..*\.Z*\.Z*\.Za$.[-\.Za$.[.\.Za$.[ \.Z:..Z)\.Z:..[#\.Z:..[;\.Z:..[.\.Za$.[!\.Z*\.Z.\.Zb..[3\.Zb..[+\.ZRich*\.Z........PE..d..

                                                                                                                                                                                                                                                      File Icon

                                                                                                                                                                                                                                                      Icon Hash:4a464cd47461e179

                                                                                                                                                                                                                                                      Static PE Info

                                                                                                                                                                                                                                                      General

                                                                                                                                                                                                                                                      Entrypoint:0x14000cdb0
                                                                                                                                                                                                                                                      Entrypoint Section:.text
                                                                                                                                                                                                                                                      Digitally signed:false
                                                                                                                                                                                                                                                      Imagebase:0x140000000
                                                                                                                                                                                                                                                      Subsystem:windows gui
                                                                                                                                                                                                                                                      Image File Characteristics:EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
                                                                                                                                                                                                                                                      DLL Characteristics:HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
                                                                                                                                                                                                                                                      Time Stamp:0x67601DBF [Mon Dec 16 12:31:59 2024 UTC]
                                                                                                                                                                                                                                                      TLS Callbacks:
                                                                                                                                                                                                                                                      CLR (.Net) Version:
                                                                                                                                                                                                                                                      OS Version Major:6
                                                                                                                                                                                                                                                      OS Version Minor:0
                                                                                                                                                                                                                                                      File Version Major:6
                                                                                                                                                                                                                                                      File Version Minor:0
                                                                                                                                                                                                                                                      Subsystem Version Major:6
                                                                                                                                                                                                                                                      Subsystem Version Minor:0
                                                                                                                                                                                                                                                      Import Hash:72c4e339b7af8ab1ed2eb3821c98713a

                                                                                                                                                                                                                                                      Entrypoint Preview

                                                                                                                                                                                                                                                      Instruction
                                                                                                                                                                                                                                                      dec eax
                                                                                                                                                                                                                                                      sub esp, 28h
                                                                                                                                                                                                                                                      call 00007F4A40D77F5Ch
                                                                                                                                                                                                                                                      dec eax
                                                                                                                                                                                                                                                      add esp, 28h
                                                                                                                                                                                                                                                      jmp 00007F4A40D77B7Fh
                                                                                                                                                                                                                                                      int3
                                                                                                                                                                                                                                                      int3
                                                                                                                                                                                                                                                      int3
                                                                                                                                                                                                                                                      int3
                                                                                                                                                                                                                                                      int3
                                                                                                                                                                                                                                                      int3
                                                                                                                                                                                                                                                      int3
                                                                                                                                                                                                                                                      int3
                                                                                                                                                                                                                                                      int3
                                                                                                                                                                                                                                                      int3
                                                                                                                                                                                                                                                      int3
                                                                                                                                                                                                                                                      int3
                                                                                                                                                                                                                                                      int3
                                                                                                                                                                                                                                                      int3
                                                                                                                                                                                                                                                      dec eax
                                                                                                                                                                                                                                                      sub esp, 28h
                                                                                                                                                                                                                                                      call 00007F4A40D78328h
                                                                                                                                                                                                                                                      test eax, eax
                                                                                                                                                                                                                                                      je 00007F4A40D77D23h
                                                                                                                                                                                                                                                      dec eax
                                                                                                                                                                                                                                                      mov eax, dword ptr [00000030h]
                                                                                                                                                                                                                                                      dec eax
                                                                                                                                                                                                                                                      mov ecx, dword ptr [eax+08h]
                                                                                                                                                                                                                                                      jmp 00007F4A40D77D07h
                                                                                                                                                                                                                                                      dec eax
                                                                                                                                                                                                                                                      cmp ecx, eax
                                                                                                                                                                                                                                                      je 00007F4A40D77D16h
                                                                                                                                                                                                                                                      xor eax, eax
                                                                                                                                                                                                                                                      dec eax
                                                                                                                                                                                                                                                      cmpxchg dword ptr [0003577Ch], ecx
                                                                                                                                                                                                                                                      jne 00007F4A40D77CF0h
                                                                                                                                                                                                                                                      xor al, al
                                                                                                                                                                                                                                                      dec eax
                                                                                                                                                                                                                                                      add esp, 28h
                                                                                                                                                                                                                                                      ret
                                                                                                                                                                                                                                                      mov al, 01h
                                                                                                                                                                                                                                                      jmp 00007F4A40D77CF9h
                                                                                                                                                                                                                                                      int3
                                                                                                                                                                                                                                                      int3
                                                                                                                                                                                                                                                      int3
                                                                                                                                                                                                                                                      dec eax
                                                                                                                                                                                                                                                      sub esp, 28h
                                                                                                                                                                                                                                                      test ecx, ecx
                                                                                                                                                                                                                                                      jne 00007F4A40D77D09h
                                                                                                                                                                                                                                                      mov byte ptr [00035765h], 00000001h
                                                                                                                                                                                                                                                      call 00007F4A40D77455h
                                                                                                                                                                                                                                                      call 00007F4A40D78740h
                                                                                                                                                                                                                                                      test al, al
                                                                                                                                                                                                                                                      jne 00007F4A40D77D06h
                                                                                                                                                                                                                                                      xor al, al
                                                                                                                                                                                                                                                      jmp 00007F4A40D77D16h
                                                                                                                                                                                                                                                      call 00007F4A40D8525Fh
                                                                                                                                                                                                                                                      test al, al
                                                                                                                                                                                                                                                      jne 00007F4A40D77D0Bh
                                                                                                                                                                                                                                                      xor ecx, ecx
                                                                                                                                                                                                                                                      call 00007F4A40D78750h
                                                                                                                                                                                                                                                      jmp 00007F4A40D77CECh
                                                                                                                                                                                                                                                      mov al, 01h
                                                                                                                                                                                                                                                      dec eax
                                                                                                                                                                                                                                                      add esp, 28h
                                                                                                                                                                                                                                                      ret
                                                                                                                                                                                                                                                      int3
                                                                                                                                                                                                                                                      int3
                                                                                                                                                                                                                                                      inc eax
                                                                                                                                                                                                                                                      push ebx
                                                                                                                                                                                                                                                      dec eax
                                                                                                                                                                                                                                                      sub esp, 20h
                                                                                                                                                                                                                                                      cmp byte ptr [0003572Ch], 00000000h
                                                                                                                                                                                                                                                      mov ebx, ecx
                                                                                                                                                                                                                                                      jne 00007F4A40D77D69h
                                                                                                                                                                                                                                                      cmp ecx, 01h
                                                                                                                                                                                                                                                      jnbe 00007F4A40D77D6Ch
                                                                                                                                                                                                                                                      call 00007F4A40D7829Eh
                                                                                                                                                                                                                                                      test eax, eax
                                                                                                                                                                                                                                                      je 00007F4A40D77D2Ah
                                                                                                                                                                                                                                                      test ebx, ebx
                                                                                                                                                                                                                                                      jne 00007F4A40D77D26h
                                                                                                                                                                                                                                                      dec eax
                                                                                                                                                                                                                                                      lea ecx, dword ptr [00035716h]
                                                                                                                                                                                                                                                      call 00007F4A40D85052h

                                                                                                                                                                                                                                                      Data Directories

                                                                                                                                                                                                                                                      NameVirtual AddressVirtual Size Is in Section
                                                                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_IMPORT0x3ca5c0x78.rdata
                                                                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_RESOURCE0x470000xf41c.rsrc
                                                                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_EXCEPTION0x440000x2250.pdata
                                                                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_BASERELOC0x570000x764.reloc
                                                                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_DEBUG0x3a0800x1c.rdata
                                                                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x39f400x140.rdata
                                                                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_IAT0x2b0000x4a0.rdata
                                                                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                                                                                                                                                                                                      Sections

                                                                                                                                                                                                                                                      NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                                                                                                                                                                                      .text0x10000x29f000x2a0002a7ae207b6295492e9da088072661752False0.5514439174107143data6.487454925709845IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                                                                      .rdata0x2b0000x12a500x12c0057258b1831c470607d36a5c0628eff30False0.5244661458333333data5.7526463108375125IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                                                                      .data0x3e0000x53f80xe00dba0caeecab624a0ccc0d577241601d1False0.134765625data1.8392217063172436IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                                                                                                      .pdata0x440000x22500x2400f5559f14427a02f0a5dbd0dd026cae54False0.470703125data5.291665041994019IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                                                                      .rsrc0x470000xf41c0xf600455788c285fcfdcb4008bc77e762818aFalse0.803099593495935data7.5549760623589695IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                                                                      .reloc0x570000x7640x800816c68eeb419ee2c08656c31c06a0fffFalse0.5576171875data5.2809528666624175IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                                                                                                                                                                                                                                      Resources

                                                                                                                                                                                                                                                      NameRVASizeTypeLanguageCountryZLIB Complexity
                                                                                                                                                                                                                                                      RT_ICON0x472080xea8Device independent bitmap graphic, 48 x 96 x 8, image size 00.585820895522388
                                                                                                                                                                                                                                                      RT_ICON0x480b00x8a8Device independent bitmap graphic, 32 x 64 x 8, image size 00.7360108303249098
                                                                                                                                                                                                                                                      RT_ICON0x489580x568Device independent bitmap graphic, 16 x 32 x 8, image size 00.755057803468208
                                                                                                                                                                                                                                                      RT_ICON0x48ec00x952cPNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced0.9975384937676757
                                                                                                                                                                                                                                                      RT_ICON0x523ec0x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 00.3887966804979253
                                                                                                                                                                                                                                                      RT_ICON0x549940x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 00.49530956848030017
                                                                                                                                                                                                                                                      RT_ICON0x55a3c0x468Device independent bitmap graphic, 16 x 32 x 32, image size 00.7207446808510638
                                                                                                                                                                                                                                                      RT_GROUP_ICON0x55ea40x68data0.7019230769230769
                                                                                                                                                                                                                                                      RT_MANIFEST0x55f0c0x50dXML 1.0 document, ASCII text0.4694508894044857

                                                                                                                                                                                                                                                      Imports

                                                                                                                                                                                                                                                      DLLImport
                                                                                                                                                                                                                                                      USER32.dllCreateWindowExW, ShutdownBlockReasonCreate, MsgWaitForMultipleObjects, ShowWindow, DestroyWindow, RegisterClassW, DefWindowProcW, PeekMessageW, DispatchMessageW, TranslateMessage, PostMessageW, GetMessageW, MessageBoxW, MessageBoxA, SystemParametersInfoW, DestroyIcon, SetWindowLongPtrW, GetWindowLongPtrW, GetClientRect, InvalidateRect, ReleaseDC, GetDC, DrawTextW, GetDialogBaseUnits, EndDialog, DialogBoxIndirectParamW, MoveWindow, SendMessageW
                                                                                                                                                                                                                                                      COMCTL32.dll
                                                                                                                                                                                                                                                      KERNEL32.dllGetACP, IsValidCodePage, GetStringTypeW, GetFileAttributesExW, SetEnvironmentVariableW, FlushFileBuffers, GetCurrentDirectoryW, LCMapStringW, CompareStringW, FlsFree, GetOEMCP, GetCPInfo, GetModuleHandleW, MulDiv, FormatMessageW, GetLastError, GetModuleFileNameW, LoadLibraryExW, SetDllDirectoryW, CreateSymbolicLinkW, GetProcAddress, GetEnvironmentStringsW, GetCommandLineW, GetEnvironmentVariableW, ExpandEnvironmentStringsW, DeleteFileW, FindClose, FindFirstFileW, FindNextFileW, GetDriveTypeW, RemoveDirectoryW, GetTempPathW, CloseHandle, QueryPerformanceCounter, QueryPerformanceFrequency, WaitForSingleObject, Sleep, GetCurrentProcess, TerminateProcess, GetExitCodeProcess, CreateProcessW, GetStartupInfoW, FreeLibrary, LocalFree, SetConsoleCtrlHandler, K32EnumProcessModules, K32GetModuleFileNameExW, CreateFileW, FindFirstFileExW, GetFinalPathNameByHandleW, MultiByteToWideChar, WideCharToMultiByte, FlsSetValue, FreeEnvironmentStringsW, GetProcessHeap, GetTimeZoneInformation, HeapSize, HeapReAlloc, WriteConsoleW, SetEndOfFile, CreateDirectoryW, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsProcessorFeaturePresent, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, RtlUnwindEx, SetLastError, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, EncodePointer, RaiseException, RtlPcToFileHeader, GetCommandLineA, GetFileInformationByHandle, GetFileType, PeekNamedPipe, SystemTimeToTzSpecificLocalTime, FileTimeToSystemTime, ReadFile, GetFullPathNameW, SetStdHandle, GetStdHandle, WriteFile, ExitProcess, GetModuleHandleExW, HeapFree, GetConsoleMode, ReadConsoleW, SetFilePointerEx, GetConsoleOutputCP, GetFileSizeEx, HeapAlloc, FlsAlloc, FlsGetValue
                                                                                                                                                                                                                                                      ADVAPI32.dllOpenProcessToken, GetTokenInformation, ConvertStringSecurityDescriptorToSecurityDescriptorW, ConvertSidToStringSidW
                                                                                                                                                                                                                                                      GDI32.dllSelectObject, DeleteObject, CreateFontIndirectW

                                                                                                                                                                                                                                                      Network Behavior

                                                                                                                                                                                                                                                      Network Port Distribution

                                                                                                                                                                                                                                                      TCP Packets

                                                                                                                                                                                                                                                      TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                                                                                                                      Dec 20, 2024 09:55:14.256908894 CET49731443192.168.2.4104.20.22.46
                                                                                                                                                                                                                                                      Dec 20, 2024 09:55:14.257008076 CET44349731104.20.22.46192.168.2.4
                                                                                                                                                                                                                                                      Dec 20, 2024 09:55:14.257110119 CET49731443192.168.2.4104.20.22.46
                                                                                                                                                                                                                                                      Dec 20, 2024 09:55:14.258028984 CET49731443192.168.2.4104.20.22.46
                                                                                                                                                                                                                                                      Dec 20, 2024 09:55:14.258059025 CET44349731104.20.22.46192.168.2.4
                                                                                                                                                                                                                                                      Dec 20, 2024 09:55:15.484909058 CET44349731104.20.22.46192.168.2.4
                                                                                                                                                                                                                                                      Dec 20, 2024 09:55:15.485589027 CET49731443192.168.2.4104.20.22.46
                                                                                                                                                                                                                                                      Dec 20, 2024 09:55:15.485675097 CET44349731104.20.22.46192.168.2.4
                                                                                                                                                                                                                                                      Dec 20, 2024 09:55:15.487660885 CET44349731104.20.22.46192.168.2.4
                                                                                                                                                                                                                                                      Dec 20, 2024 09:55:15.487746000 CET49731443192.168.2.4104.20.22.46
                                                                                                                                                                                                                                                      Dec 20, 2024 09:55:15.489037037 CET49731443192.168.2.4104.20.22.46
                                                                                                                                                                                                                                                      Dec 20, 2024 09:55:15.489248037 CET44349731104.20.22.46192.168.2.4
                                                                                                                                                                                                                                                      Dec 20, 2024 09:55:15.489284992 CET49731443192.168.2.4104.20.22.46
                                                                                                                                                                                                                                                      Dec 20, 2024 09:55:15.489308119 CET49731443192.168.2.4104.20.22.46

                                                                                                                                                                                                                                                      UDP Packets

                                                                                                                                                                                                                                                      TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                                                                                                                      Dec 20, 2024 09:55:14.115966082 CET4924153192.168.2.41.1.1.1
                                                                                                                                                                                                                                                      Dec 20, 2024 09:55:14.252846003 CET53492411.1.1.1192.168.2.4

                                                                                                                                                                                                                                                      DNS Queries

                                                                                                                                                                                                                                                      TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                                                                                                                                                                                                                      Dec 20, 2024 09:55:14.115966082 CET192.168.2.41.1.1.10x526bStandard query (0)nodejs.orgA (IP address)IN (0x0001)false

                                                                                                                                                                                                                                                      DNS Answers

                                                                                                                                                                                                                                                      TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                                                                                                                                                                                                                      Dec 20, 2024 09:55:14.252846003 CET1.1.1.1192.168.2.40x526bNo error (0)nodejs.org104.20.22.46A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                      Dec 20, 2024 09:55:14.252846003 CET1.1.1.1192.168.2.40x526bNo error (0)nodejs.org104.20.23.46A (IP address)IN (0x0001)false

                                                                                                                                                                                                                                                      Statistics

                                                                                                                                                                                                                                                      CPU Usage

                                                                                                                                                                                                                                                      Click to jump to process

                                                                                                                                                                                                                                                      Memory Usage

                                                                                                                                                                                                                                                      Click to jump to process

                                                                                                                                                                                                                                                      High Level Behavior Distribution

                                                                                                                                                                                                                                                      Click to dive into process behavior distribution

                                                                                                                                                                                                                                                      Behavior

                                                                                                                                                                                                                                                      Click to jump to process

                                                                                                                                                                                                                                                      System Behavior

                                                                                                                                                                                                                                                      General

                                                                                                                                                                                                                                                      Target ID:0
                                                                                                                                                                                                                                                      Start time:03:55:01
                                                                                                                                                                                                                                                      Start date:20/12/2024
                                                                                                                                                                                                                                                      Path:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                                                                      Commandline:"C:\Users\user\Desktop\wp-s2.exe"
                                                                                                                                                                                                                                                      Imagebase:0x7ff6d09e0000
                                                                                                                                                                                                                                                      File size:38'752'565 bytes
                                                                                                                                                                                                                                                      MD5 hash:62370A84134040D803EAE9A4BD34342C
                                                                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                                                                                      General

                                                                                                                                                                                                                                                      Target ID:1
                                                                                                                                                                                                                                                      Start time:03:55:07
                                                                                                                                                                                                                                                      Start date:20/12/2024
                                                                                                                                                                                                                                                      Path:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                                                                      Commandline:"C:\Users\user\Desktop\wp-s2.exe"
                                                                                                                                                                                                                                                      Imagebase:0x7ff6d09e0000
                                                                                                                                                                                                                                                      File size:38'752'565 bytes
                                                                                                                                                                                                                                                      MD5 hash:62370A84134040D803EAE9A4BD34342C
                                                                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                      Yara matches:
                                                                                                                                                                                                                                                      • Rule: JoeSecurity_PythonBackDoor_1, Description: Yara detected Python BackDoor, Source: 00000001.00000002.2082080905.000001B81E841000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                                      • Rule: JoeSecurity_PythonBackDoor_1, Description: Yara detected Python BackDoor, Source: 00000001.00000003.1755036913.000001B81EABA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                                      • Rule: JoeSecurity_PythonBackDoor_1, Description: Yara detected Python BackDoor, Source: 00000001.00000003.1755225796.000001B81E7F6000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                                      • Rule: JoeSecurity_PythonBackDoor_1, Description: Yara detected Python BackDoor, Source: 00000001.00000003.1758008751.000001B81E7F6000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                                      • Rule: JoeSecurity_PythonBackDoor_1, Description: Yara detected Python BackDoor, Source: 00000001.00000003.1755864798.000001B81EABD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                                      • Rule: JoeSecurity_PythonBackDoor_1, Description: Yara detected Python BackDoor, Source: 00000001.00000003.1757583955.000001B81E7F6000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                                      • Rule: JoeSecurity_PythonBackDoor_1, Description: Yara detected Python BackDoor, Source: 00000001.00000003.1756150289.000001B81E7F6000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                                      • Rule: JoeSecurity_PythonBackDoor_1, Description: Yara detected Python BackDoor, Source: 00000001.00000002.2082516614.000001B81EAA1000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                                      • Rule: JoeSecurity_PythonBackDoor_1, Description: Yara detected Python BackDoor, Source: 00000001.00000003.1757204060.000001B81E7F6000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                                                                                      General

                                                                                                                                                                                                                                                      Target ID:2
                                                                                                                                                                                                                                                      Start time:03:55:11
                                                                                                                                                                                                                                                      Start date:20/12/2024
                                                                                                                                                                                                                                                      Path:C:\Windows\System32\systeminfo.exe
                                                                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                                                                      Commandline:systeminfo
                                                                                                                                                                                                                                                      Imagebase:0x7ff689160000
                                                                                                                                                                                                                                                      File size:110'080 bytes
                                                                                                                                                                                                                                                      MD5 hash:EE309A9C61511E907D87B10EF226FDCD
                                                                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                      Reputation:moderate
                                                                                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                                                                                      General

                                                                                                                                                                                                                                                      Target ID:3
                                                                                                                                                                                                                                                      Start time:03:55:11
                                                                                                                                                                                                                                                      Start date:20/12/2024
                                                                                                                                                                                                                                                      Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                      Imagebase:0x7ff7699e0000
                                                                                                                                                                                                                                                      File size:862'208 bytes
                                                                                                                                                                                                                                                      MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                      Reputation:high
                                                                                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                                                                                      General

                                                                                                                                                                                                                                                      Target ID:4
                                                                                                                                                                                                                                                      Start time:03:55:12
                                                                                                                                                                                                                                                      Start date:20/12/2024
                                                                                                                                                                                                                                                      Path:C:\Windows\System32\wbem\WmiPrvSE.exe
                                                                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                                                                      Commandline:C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
                                                                                                                                                                                                                                                      Imagebase:0x7ff693ab0000
                                                                                                                                                                                                                                                      File size:496'640 bytes
                                                                                                                                                                                                                                                      MD5 hash:60FF40CFD7FB8FE41EE4FE9AE5FE1C51
                                                                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                                                                      Has administrator privileges:false
                                                                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                      Reputation:high
                                                                                                                                                                                                                                                      Has exited:false

                                                                                                                                                                                                                                                      General

                                                                                                                                                                                                                                                      Target ID:5
                                                                                                                                                                                                                                                      Start time:03:55:12
                                                                                                                                                                                                                                                      Start date:20/12/2024
                                                                                                                                                                                                                                                      Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                                                                      Commandline:C:\Windows\system32\cmd.exe /c "wmic computersystem get manufacturer"
                                                                                                                                                                                                                                                      Imagebase:0x7ff652b50000
                                                                                                                                                                                                                                                      File size:289'792 bytes
                                                                                                                                                                                                                                                      MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                      Reputation:high
                                                                                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                                                                                      General

                                                                                                                                                                                                                                                      Target ID:6
                                                                                                                                                                                                                                                      Start time:03:55:12
                                                                                                                                                                                                                                                      Start date:20/12/2024
                                                                                                                                                                                                                                                      Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                      Imagebase:0x7ff7699e0000
                                                                                                                                                                                                                                                      File size:862'208 bytes
                                                                                                                                                                                                                                                      MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                      Reputation:high
                                                                                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                                                                                      General

                                                                                                                                                                                                                                                      Target ID:7
                                                                                                                                                                                                                                                      Start time:03:55:12
                                                                                                                                                                                                                                                      Start date:20/12/2024
                                                                                                                                                                                                                                                      Path:C:\Windows\System32\wbem\WMIC.exe
                                                                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                                                                      Commandline:wmic computersystem get manufacturer
                                                                                                                                                                                                                                                      Imagebase:0x7ff7409a0000
                                                                                                                                                                                                                                                      File size:576'000 bytes
                                                                                                                                                                                                                                                      MD5 hash:C37F2F4F4B3CD128BDABCAEB2266A785
                                                                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                      Reputation:high
                                                                                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                                                                                      General

                                                                                                                                                                                                                                                      Target ID:11
                                                                                                                                                                                                                                                      Start time:03:55:17
                                                                                                                                                                                                                                                      Start date:20/12/2024
                                                                                                                                                                                                                                                      Path:C:\Windows\System32\WerFault.exe
                                                                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                                                                      Commandline:C:\Windows\system32\WerFault.exe -u -p 6752 -s 940
                                                                                                                                                                                                                                                      Imagebase:0x7ff737880000
                                                                                                                                                                                                                                                      File size:570'736 bytes
                                                                                                                                                                                                                                                      MD5 hash:FD27D9F6D02763BDE32511B5DF7FF7A0
                                                                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                      Reputation:high
                                                                                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                                                                                      Disassembly

                                                                                                                                                                                                                                                      Reset < >

                                                                                                                                                                                                                                                        Execution Graph

                                                                                                                                                                                                                                                        Execution Coverage:10.2%
                                                                                                                                                                                                                                                        Dynamic/Decrypted Code Coverage:0%
                                                                                                                                                                                                                                                        Signature Coverage:19.7%
                                                                                                                                                                                                                                                        Total number of Nodes:2000
                                                                                                                                                                                                                                                        Total number of Limit Nodes:44
                                                                                                                                                                                                                                                        execution_graph 19895 7ff6d0a0ad69 19898 7ff6d09f5478 LeaveCriticalSection 19895->19898 16014 7ff6d09f9961 16026 7ff6d09fa3d8 16014->16026 16031 7ff6d09fb150 GetLastError 16026->16031 16032 7ff6d09fb174 FlsGetValue 16031->16032 16033 7ff6d09fb191 FlsSetValue 16031->16033 16034 7ff6d09fb18b 16032->16034 16050 7ff6d09fb181 SetLastError 16032->16050 16035 7ff6d09fb1a3 16033->16035 16033->16050 16034->16033 16062 7ff6d09feb98 16035->16062 16039 7ff6d09fb21d 16043 7ff6d09fa504 _CallSETranslator 38 API calls 16039->16043 16040 7ff6d09fa3e1 16053 7ff6d09fa504 16040->16053 16041 7ff6d09fb1d0 FlsSetValue 16046 7ff6d09fb1ee 16041->16046 16047 7ff6d09fb1dc FlsSetValue 16041->16047 16042 7ff6d09fb1c0 FlsSetValue 16045 7ff6d09fb1c9 16042->16045 16044 7ff6d09fb222 16043->16044 16069 7ff6d09fa948 16045->16069 16075 7ff6d09faef4 16046->16075 16047->16045 16050->16039 16050->16040 16123 7ff6d0a03650 16053->16123 16067 7ff6d09feba9 memcpy_s 16062->16067 16063 7ff6d09febfa 16083 7ff6d09f4f08 16063->16083 16064 7ff6d09febde HeapAlloc 16065 7ff6d09fb1b2 16064->16065 16064->16067 16065->16041 16065->16042 16067->16063 16067->16064 16080 7ff6d0a03590 16067->16080 16070 7ff6d09fa97c 16069->16070 16071 7ff6d09fa94d RtlFreeHeap 16069->16071 16070->16050 16071->16070 16072 7ff6d09fa968 GetLastError 16071->16072 16073 7ff6d09fa975 __free_lconv_num 16072->16073 16074 7ff6d09f4f08 memcpy_s 9 API calls 16073->16074 16074->16070 16109 7ff6d09fadcc 16075->16109 16086 7ff6d0a035d0 16080->16086 16092 7ff6d09fb2c8 GetLastError 16083->16092 16085 7ff6d09f4f11 16085->16065 16091 7ff6d0a002d8 EnterCriticalSection 16086->16091 16093 7ff6d09fb2ec 16092->16093 16094 7ff6d09fb309 FlsSetValue 16092->16094 16093->16094 16107 7ff6d09fb2f9 16093->16107 16095 7ff6d09fb31b 16094->16095 16094->16107 16097 7ff6d09feb98 memcpy_s 5 API calls 16095->16097 16096 7ff6d09fb375 SetLastError 16096->16085 16098 7ff6d09fb32a 16097->16098 16099 7ff6d09fb348 FlsSetValue 16098->16099 16100 7ff6d09fb338 FlsSetValue 16098->16100 16102 7ff6d09fb354 FlsSetValue 16099->16102 16103 7ff6d09fb366 16099->16103 16101 7ff6d09fb341 16100->16101 16105 7ff6d09fa948 __free_lconv_num 5 API calls 16101->16105 16102->16101 16104 7ff6d09faef4 memcpy_s 5 API calls 16103->16104 16106 7ff6d09fb36e 16104->16106 16105->16107 16108 7ff6d09fa948 __free_lconv_num 5 API calls 16106->16108 16107->16096 16108->16096 16121 7ff6d0a002d8 EnterCriticalSection 16109->16121 16157 7ff6d0a03608 16123->16157 16162 7ff6d0a002d8 EnterCriticalSection 16157->16162 16227 7ff6d09ebae0 16228 7ff6d09ebb0e 16227->16228 16229 7ff6d09ebaf5 16227->16229 16229->16228 16232 7ff6d09fd5fc 16229->16232 16233 7ff6d09fd647 16232->16233 16237 7ff6d09fd60b memcpy_s 16232->16237 16235 7ff6d09f4f08 memcpy_s 11 API calls 16233->16235 16234 7ff6d09fd62e HeapAlloc 16236 7ff6d09ebb6e 16234->16236 16234->16237 16235->16236 16237->16233 16237->16234 16238 7ff6d0a03590 memcpy_s 2 API calls 16237->16238 16238->16237 19711 7ff6d0a0abe3 19712 7ff6d0a0abf3 19711->19712 19715 7ff6d09f5478 LeaveCriticalSection 19712->19715 16239 7ff6d09ecc3c 16260 7ff6d09ece0c 16239->16260 16242 7ff6d09ecd88 16414 7ff6d09ed12c IsProcessorFeaturePresent 16242->16414 16243 7ff6d09ecc58 __scrt_acquire_startup_lock 16245 7ff6d09ecd92 16243->16245 16252 7ff6d09ecc76 __scrt_release_startup_lock 16243->16252 16246 7ff6d09ed12c 7 API calls 16245->16246 16248 7ff6d09ecd9d _CallSETranslator 16246->16248 16247 7ff6d09ecc9b 16249 7ff6d09ecd21 16266 7ff6d09ed274 16249->16266 16251 7ff6d09ecd26 16269 7ff6d09e1000 16251->16269 16252->16247 16252->16249 16403 7ff6d09f9b2c 16252->16403 16257 7ff6d09ecd49 16257->16248 16410 7ff6d09ecf90 16257->16410 16261 7ff6d09ece14 16260->16261 16262 7ff6d09ece20 __scrt_dllmain_crt_thread_attach 16261->16262 16263 7ff6d09ecc50 16262->16263 16264 7ff6d09ece2d 16262->16264 16263->16242 16263->16243 16264->16263 16421 7ff6d09ed888 16264->16421 16448 7ff6d0a0a4d0 16266->16448 16268 7ff6d09ed28b GetStartupInfoW 16268->16251 16270 7ff6d09e1009 16269->16270 16450 7ff6d09f5484 16270->16450 16272 7ff6d09e37fb 16457 7ff6d09e36b0 16272->16457 16275 7ff6d09e3808 __std_exception_destroy 16278 7ff6d09ec550 _log10_special 8 API calls 16275->16278 16281 7ff6d09e3ca7 16278->16281 16279 7ff6d09e391b 16626 7ff6d09e45c0 16279->16626 16280 7ff6d09e383c 16617 7ff6d09e1c80 16280->16617 16408 7ff6d09ed2b8 GetModuleHandleW 16281->16408 16284 7ff6d09e385b 16529 7ff6d09e8830 16284->16529 16287 7ff6d09e396a 16649 7ff6d09e2710 16287->16649 16289 7ff6d09e388e 16297 7ff6d09e38bb __std_exception_destroy 16289->16297 16621 7ff6d09e89a0 16289->16621 16291 7ff6d09e395d 16292 7ff6d09e3962 16291->16292 16293 7ff6d09e3984 16291->16293 16645 7ff6d09f004c 16292->16645 16295 7ff6d09e1c80 49 API calls 16293->16295 16298 7ff6d09e39a3 16295->16298 16299 7ff6d09e8830 14 API calls 16297->16299 16306 7ff6d09e38de __std_exception_destroy 16297->16306 16303 7ff6d09e1950 115 API calls 16298->16303 16299->16306 16301 7ff6d09e3a0b 16302 7ff6d09e89a0 40 API calls 16301->16302 16304 7ff6d09e3a17 16302->16304 16305 7ff6d09e39ce 16303->16305 16307 7ff6d09e89a0 40 API calls 16304->16307 16305->16284 16308 7ff6d09e39de 16305->16308 16312 7ff6d09e390e __std_exception_destroy 16306->16312 16660 7ff6d09e8940 16306->16660 16309 7ff6d09e3a23 16307->16309 16310 7ff6d09e2710 54 API calls 16308->16310 16311 7ff6d09e89a0 40 API calls 16309->16311 16310->16275 16311->16312 16313 7ff6d09e8830 14 API calls 16312->16313 16314 7ff6d09e3a3b 16313->16314 16315 7ff6d09e3b2f 16314->16315 16316 7ff6d09e3a60 __std_exception_destroy 16314->16316 16317 7ff6d09e2710 54 API calls 16315->16317 16318 7ff6d09e8940 40 API calls 16316->16318 16320 7ff6d09e3aab 16316->16320 16317->16275 16318->16320 16319 7ff6d09e8830 14 API calls 16321 7ff6d09e3bf4 __std_exception_destroy 16319->16321 16320->16319 16322 7ff6d09e3d41 16321->16322 16323 7ff6d09e3c46 16321->16323 16667 7ff6d09e44e0 16322->16667 16324 7ff6d09e3cd4 16323->16324 16325 7ff6d09e3c50 16323->16325 16328 7ff6d09e8830 14 API calls 16324->16328 16542 7ff6d09e90e0 16325->16542 16331 7ff6d09e3ce0 16328->16331 16329 7ff6d09e3d4f 16332 7ff6d09e3d65 16329->16332 16333 7ff6d09e3d71 16329->16333 16334 7ff6d09e3c61 16331->16334 16337 7ff6d09e3ced 16331->16337 16670 7ff6d09e4630 16332->16670 16336 7ff6d09e1c80 49 API calls 16333->16336 16340 7ff6d09e2710 54 API calls 16334->16340 16347 7ff6d09e3cc8 __std_exception_destroy 16336->16347 16341 7ff6d09e1c80 49 API calls 16337->16341 16340->16275 16344 7ff6d09e3d0b 16341->16344 16342 7ff6d09e3dc4 16592 7ff6d09e9390 16342->16592 16346 7ff6d09e3d12 16344->16346 16344->16347 16345 7ff6d09e3dd7 SetDllDirectoryW 16351 7ff6d09e3e0a 16345->16351 16393 7ff6d09e3e5a 16345->16393 16350 7ff6d09e2710 54 API calls 16346->16350 16347->16342 16348 7ff6d09e3da7 SetDllDirectoryW LoadLibraryExW 16347->16348 16348->16342 16350->16275 16353 7ff6d09e8830 14 API calls 16351->16353 16352 7ff6d09e4008 16355 7ff6d09e4012 PostMessageW GetMessageW 16352->16355 16356 7ff6d09e4035 16352->16356 16360 7ff6d09e3e16 __std_exception_destroy 16353->16360 16354 7ff6d09e3f1b 16597 7ff6d09e33c0 16354->16597 16355->16356 16747 7ff6d09e3360 16356->16747 16363 7ff6d09e3ef2 16360->16363 16367 7ff6d09e3e4e 16360->16367 16366 7ff6d09e8940 40 API calls 16363->16366 16366->16393 16367->16393 16673 7ff6d09e6dc0 16367->16673 16393->16352 16393->16354 16404 7ff6d09f9b64 16403->16404 16405 7ff6d09f9b43 16403->16405 16406 7ff6d09fa3d8 45 API calls 16404->16406 16405->16249 16407 7ff6d09f9b69 16406->16407 16409 7ff6d09ed2c9 16408->16409 16409->16257 16411 7ff6d09ecfa1 16410->16411 16412 7ff6d09ecd60 16411->16412 16413 7ff6d09ed888 7 API calls 16411->16413 16412->16247 16413->16412 16415 7ff6d09ed152 _isindst memcpy_s 16414->16415 16416 7ff6d09ed171 RtlCaptureContext RtlLookupFunctionEntry 16415->16416 16417 7ff6d09ed19a RtlVirtualUnwind 16416->16417 16418 7ff6d09ed1d6 memcpy_s 16416->16418 16417->16418 16419 7ff6d09ed208 IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter 16418->16419 16420 7ff6d09ed256 _isindst 16419->16420 16420->16245 16422 7ff6d09ed890 16421->16422 16423 7ff6d09ed89a 16421->16423 16427 7ff6d09edc24 16422->16427 16423->16263 16428 7ff6d09edc33 16427->16428 16429 7ff6d09ed895 16427->16429 16435 7ff6d09ede60 16428->16435 16431 7ff6d09edc90 16429->16431 16432 7ff6d09edcbb 16431->16432 16433 7ff6d09edc9e DeleteCriticalSection 16432->16433 16434 7ff6d09edcbf 16432->16434 16433->16432 16434->16423 16439 7ff6d09edcc8 16435->16439 16440 7ff6d09eddb2 TlsFree 16439->16440 16445 7ff6d09edd0c __vcrt_InitializeCriticalSectionEx 16439->16445 16441 7ff6d09edd3a LoadLibraryExW 16442 7ff6d09edd5b GetLastError 16441->16442 16443 7ff6d09eddd9 16441->16443 16442->16445 16444 7ff6d09eddf9 GetProcAddress 16443->16444 16446 7ff6d09eddf0 FreeLibrary 16443->16446 16444->16440 16445->16440 16445->16441 16445->16444 16447 7ff6d09edd7d LoadLibraryExW 16445->16447 16446->16444 16447->16443 16447->16445 16449 7ff6d0a0a4c0 16448->16449 16449->16268 16449->16449 16453 7ff6d09ff480 16450->16453 16451 7ff6d09ff4d3 16452 7ff6d09fa814 _invalid_parameter_noinfo 37 API calls 16451->16452 16455 7ff6d09ff4fc 16452->16455 16453->16451 16454 7ff6d09ff526 16453->16454 16760 7ff6d09ff358 16454->16760 16455->16272 16768 7ff6d09ec850 16457->16768 16460 7ff6d09e3710 16770 7ff6d09e9280 FindFirstFileExW 16460->16770 16461 7ff6d09e36eb GetLastError 16775 7ff6d09e2c50 16461->16775 16464 7ff6d09e3706 16469 7ff6d09ec550 _log10_special 8 API calls 16464->16469 16466 7ff6d09e3723 16790 7ff6d09e9300 CreateFileW 16466->16790 16467 7ff6d09e377d 16801 7ff6d09e9440 16467->16801 16472 7ff6d09e37b5 16469->16472 16471 7ff6d09e378b 16471->16464 16477 7ff6d09e2810 49 API calls 16471->16477 16472->16275 16479 7ff6d09e1950 16472->16479 16474 7ff6d09e3734 16793 7ff6d09e2810 16474->16793 16475 7ff6d09e374c __vcrt_InitializeCriticalSectionEx 16475->16467 16477->16464 16480 7ff6d09e45c0 108 API calls 16479->16480 16481 7ff6d09e1985 16480->16481 16482 7ff6d09e1c43 16481->16482 16483 7ff6d09e7f90 83 API calls 16481->16483 16484 7ff6d09ec550 _log10_special 8 API calls 16482->16484 16485 7ff6d09e19cb 16483->16485 16486 7ff6d09e1c5e 16484->16486 16528 7ff6d09e1a03 16485->16528 17174 7ff6d09f06d4 16485->17174 16486->16279 16486->16280 16488 7ff6d09f004c 74 API calls 16488->16482 16489 7ff6d09e19e5 16490 7ff6d09e19e9 16489->16490 16491 7ff6d09e1a08 16489->16491 16493 7ff6d09f4f08 memcpy_s 11 API calls 16490->16493 17178 7ff6d09f039c 16491->17178 16495 7ff6d09e19ee 16493->16495 17181 7ff6d09e2910 16495->17181 16496 7ff6d09e1a45 16502 7ff6d09e1a7b 16496->16502 16503 7ff6d09e1a5c 16496->16503 16497 7ff6d09e1a26 16499 7ff6d09f4f08 memcpy_s 11 API calls 16497->16499 16500 7ff6d09e1a2b 16499->16500 16501 7ff6d09e2910 54 API calls 16500->16501 16501->16528 16504 7ff6d09e1c80 49 API calls 16502->16504 16505 7ff6d09f4f08 memcpy_s 11 API calls 16503->16505 16506 7ff6d09e1a92 16504->16506 16507 7ff6d09e1a61 16505->16507 16508 7ff6d09e1c80 49 API calls 16506->16508 16509 7ff6d09e2910 54 API calls 16507->16509 16510 7ff6d09e1add 16508->16510 16509->16528 16511 7ff6d09f06d4 73 API calls 16510->16511 16512 7ff6d09e1b01 16511->16512 16513 7ff6d09e1b35 16512->16513 16514 7ff6d09e1b16 16512->16514 16516 7ff6d09f039c _fread_nolock 53 API calls 16513->16516 16515 7ff6d09f4f08 memcpy_s 11 API calls 16514->16515 16517 7ff6d09e1b1b 16515->16517 16518 7ff6d09e1b4a 16516->16518 16521 7ff6d09e2910 54 API calls 16517->16521 16519 7ff6d09e1b6f 16518->16519 16520 7ff6d09e1b50 16518->16520 17196 7ff6d09f0110 16519->17196 16522 7ff6d09f4f08 memcpy_s 11 API calls 16520->16522 16521->16528 16524 7ff6d09e1b55 16522->16524 16526 7ff6d09e2910 54 API calls 16524->16526 16526->16528 16527 7ff6d09e2710 54 API calls 16527->16528 16528->16488 16530 7ff6d09e883a 16529->16530 16531 7ff6d09e9390 2 API calls 16530->16531 16532 7ff6d09e8859 GetEnvironmentVariableW 16531->16532 16533 7ff6d09e88c2 16532->16533 16534 7ff6d09e8876 ExpandEnvironmentStringsW 16532->16534 16536 7ff6d09ec550 _log10_special 8 API calls 16533->16536 16534->16533 16535 7ff6d09e8898 16534->16535 16537 7ff6d09e9440 2 API calls 16535->16537 16538 7ff6d09e88d4 16536->16538 16539 7ff6d09e88aa 16537->16539 16538->16289 16540 7ff6d09ec550 _log10_special 8 API calls 16539->16540 16541 7ff6d09e88ba 16540->16541 16541->16289 16543 7ff6d09e90f5 16542->16543 17414 7ff6d09e8570 GetCurrentProcess OpenProcessToken 16543->17414 16546 7ff6d09e8570 7 API calls 16547 7ff6d09e9121 16546->16547 16548 7ff6d09e9154 16547->16548 16549 7ff6d09e913a 16547->16549 16551 7ff6d09e26b0 48 API calls 16548->16551 16550 7ff6d09e26b0 48 API calls 16549->16550 16552 7ff6d09e9152 16550->16552 16553 7ff6d09e9167 LocalFree LocalFree 16551->16553 16552->16553 16554 7ff6d09e9183 16553->16554 16557 7ff6d09e918f 16553->16557 17424 7ff6d09e2b50 16554->17424 16556 7ff6d09ec550 _log10_special 8 API calls 16558 7ff6d09e3c55 16556->16558 16557->16556 16558->16334 16559 7ff6d09e8660 16558->16559 16560 7ff6d09e8678 16559->16560 16561 7ff6d09e869c 16560->16561 16562 7ff6d09e86fa GetTempPathW GetCurrentProcessId 16560->16562 16564 7ff6d09e8830 14 API calls 16561->16564 17433 7ff6d09e25c0 16562->17433 16565 7ff6d09e86a8 16564->16565 17440 7ff6d09e81d0 16565->17440 16571 7ff6d09e8728 __std_exception_destroy 16579 7ff6d09e8765 __std_exception_destroy 16571->16579 17437 7ff6d09f8b68 16571->17437 16577 7ff6d09e87d4 __std_exception_destroy 16578 7ff6d09ec550 _log10_special 8 API calls 16577->16578 16580 7ff6d09e3cbb 16578->16580 16579->16577 16584 7ff6d09e9390 2 API calls 16579->16584 16580->16334 16580->16347 16585 7ff6d09e87b1 16584->16585 16586 7ff6d09e87e9 16585->16586 16587 7ff6d09e87b6 16585->16587 16589 7ff6d09f8238 38 API calls 16586->16589 16588 7ff6d09e9390 2 API calls 16587->16588 16590 7ff6d09e87c6 16588->16590 16589->16577 16591 7ff6d09f8238 38 API calls 16590->16591 16591->16577 16593 7ff6d09e93b2 MultiByteToWideChar 16592->16593 16595 7ff6d09e93d6 16592->16595 16593->16595 16596 7ff6d09e93ec __std_exception_destroy 16593->16596 16594 7ff6d09e93f3 MultiByteToWideChar 16594->16596 16595->16594 16595->16596 16596->16345 16608 7ff6d09e33ce memcpy_s 16597->16608 16598 7ff6d09ec550 _log10_special 8 API calls 16600 7ff6d09e3664 16598->16600 16599 7ff6d09e35c7 16599->16598 16600->16275 16616 7ff6d09e90c0 LocalFree 16600->16616 16602 7ff6d09e1c80 49 API calls 16602->16608 16603 7ff6d09e35e2 16605 7ff6d09e2710 54 API calls 16603->16605 16605->16599 16607 7ff6d09e35c9 16611 7ff6d09e2710 54 API calls 16607->16611 16608->16599 16608->16602 16608->16603 16608->16607 16610 7ff6d09e2a50 54 API calls 16608->16610 16614 7ff6d09e35d0 16608->16614 17729 7ff6d09e4560 16608->17729 17735 7ff6d09e7e20 16608->17735 17746 7ff6d09e1600 16608->17746 17794 7ff6d09e7120 16608->17794 17798 7ff6d09e4190 16608->17798 17842 7ff6d09e4450 16608->17842 16610->16608 16611->16599 16615 7ff6d09e2710 54 API calls 16614->16615 16615->16599 16618 7ff6d09e1ca5 16617->16618 16619 7ff6d09f4984 49 API calls 16618->16619 16620 7ff6d09e1cc8 16619->16620 16620->16284 16622 7ff6d09e9390 2 API calls 16621->16622 16623 7ff6d09e89b4 16622->16623 16624 7ff6d09f8238 38 API calls 16623->16624 16625 7ff6d09e89c6 __std_exception_destroy 16624->16625 16625->16297 16627 7ff6d09e45cc 16626->16627 16628 7ff6d09e9390 2 API calls 16627->16628 16629 7ff6d09e45f4 16628->16629 16630 7ff6d09e9390 2 API calls 16629->16630 16631 7ff6d09e4607 16630->16631 18025 7ff6d09f5f94 16631->18025 16634 7ff6d09ec550 _log10_special 8 API calls 16635 7ff6d09e392b 16634->16635 16635->16287 16636 7ff6d09e7f90 16635->16636 16637 7ff6d09e7fb4 16636->16637 16638 7ff6d09f06d4 73 API calls 16637->16638 16643 7ff6d09e808b __std_exception_destroy 16637->16643 16639 7ff6d09e7fd0 16638->16639 16639->16643 18416 7ff6d09f78c8 16639->18416 16641 7ff6d09f06d4 73 API calls 16644 7ff6d09e7fe5 16641->16644 16642 7ff6d09f039c _fread_nolock 53 API calls 16642->16644 16643->16291 16644->16641 16644->16642 16644->16643 16646 7ff6d09f007c 16645->16646 18431 7ff6d09efe28 16646->18431 16648 7ff6d09f0095 16648->16287 16650 7ff6d09ec850 16649->16650 16651 7ff6d09e2734 GetCurrentProcessId 16650->16651 16652 7ff6d09e1c80 49 API calls 16651->16652 16653 7ff6d09e2787 16652->16653 16654 7ff6d09f4984 49 API calls 16653->16654 16655 7ff6d09e27cf 16654->16655 16656 7ff6d09e2620 12 API calls 16655->16656 16657 7ff6d09e27f1 16656->16657 16658 7ff6d09ec550 _log10_special 8 API calls 16657->16658 16659 7ff6d09e2801 16658->16659 16659->16275 16661 7ff6d09e9390 2 API calls 16660->16661 16662 7ff6d09e895c 16661->16662 16663 7ff6d09e9390 2 API calls 16662->16663 16664 7ff6d09e896c 16663->16664 16665 7ff6d09f8238 38 API calls 16664->16665 16666 7ff6d09e897a __std_exception_destroy 16665->16666 16666->16301 16668 7ff6d09e1c80 49 API calls 16667->16668 16669 7ff6d09e44fd 16668->16669 16669->16329 16671 7ff6d09e1c80 49 API calls 16670->16671 16672 7ff6d09e4660 16671->16672 16672->16347 16674 7ff6d09e6dd5 16673->16674 16675 7ff6d09e3e6c 16674->16675 16676 7ff6d09f4f08 memcpy_s 11 API calls 16674->16676 16679 7ff6d09e7340 16675->16679 16677 7ff6d09e6de2 16676->16677 16678 7ff6d09e2910 54 API calls 16677->16678 16678->16675 18442 7ff6d09e1470 16679->18442 16681 7ff6d09e7368 16682 7ff6d09e4630 49 API calls 16681->16682 16692 7ff6d09e74b9 __std_exception_destroy 16681->16692 16683 7ff6d09e738a 16682->16683 18548 7ff6d09e6360 16747->18548 16755 7ff6d09e3399 16756 7ff6d09e3670 16755->16756 16757 7ff6d09e367e 16756->16757 16767 7ff6d09f546c EnterCriticalSection 16760->16767 16769 7ff6d09e36bc GetModuleFileNameW 16768->16769 16769->16460 16769->16461 16771 7ff6d09e92d2 16770->16771 16772 7ff6d09e92bf FindClose 16770->16772 16773 7ff6d09ec550 _log10_special 8 API calls 16771->16773 16772->16771 16774 7ff6d09e371a 16773->16774 16774->16466 16774->16467 16776 7ff6d09ec850 16775->16776 16777 7ff6d09e2c70 GetCurrentProcessId 16776->16777 16806 7ff6d09e26b0 16777->16806 16779 7ff6d09e2cb9 16810 7ff6d09f4bd8 16779->16810 16782 7ff6d09e26b0 48 API calls 16783 7ff6d09e2d34 FormatMessageW 16782->16783 16785 7ff6d09e2d7f MessageBoxW 16783->16785 16786 7ff6d09e2d6d 16783->16786 16788 7ff6d09ec550 _log10_special 8 API calls 16785->16788 16787 7ff6d09e26b0 48 API calls 16786->16787 16787->16785 16789 7ff6d09e2daf 16788->16789 16789->16464 16791 7ff6d09e9340 GetFinalPathNameByHandleW CloseHandle 16790->16791 16792 7ff6d09e3730 16790->16792 16791->16792 16792->16474 16792->16475 16794 7ff6d09e2834 16793->16794 16795 7ff6d09e26b0 48 API calls 16794->16795 16796 7ff6d09e2887 16795->16796 16797 7ff6d09f4bd8 48 API calls 16796->16797 16798 7ff6d09e28d0 MessageBoxW 16797->16798 16799 7ff6d09ec550 _log10_special 8 API calls 16798->16799 16800 7ff6d09e2900 16799->16800 16800->16464 16802 7ff6d09e946a WideCharToMultiByte 16801->16802 16805 7ff6d09e9495 16801->16805 16803 7ff6d09e94ab __std_exception_destroy 16802->16803 16802->16805 16803->16471 16804 7ff6d09e94b2 WideCharToMultiByte 16804->16803 16805->16803 16805->16804 16807 7ff6d09e26d5 16806->16807 16808 7ff6d09f4bd8 48 API calls 16807->16808 16809 7ff6d09e26f8 16808->16809 16809->16779 16811 7ff6d09f4c32 16810->16811 16812 7ff6d09f4c57 16811->16812 16814 7ff6d09f4c93 16811->16814 16813 7ff6d09fa814 _invalid_parameter_noinfo 37 API calls 16812->16813 16816 7ff6d09f4c81 16813->16816 16828 7ff6d09f2f90 16814->16828 16819 7ff6d09ec550 _log10_special 8 API calls 16816->16819 16817 7ff6d09f4d74 16818 7ff6d09fa948 __free_lconv_num 11 API calls 16817->16818 16818->16816 16821 7ff6d09e2d04 16819->16821 16821->16782 16822 7ff6d09f4d9a 16822->16817 16825 7ff6d09f4da4 16822->16825 16823 7ff6d09f4d49 16826 7ff6d09fa948 __free_lconv_num 11 API calls 16823->16826 16824 7ff6d09f4d40 16824->16817 16824->16823 16827 7ff6d09fa948 __free_lconv_num 11 API calls 16825->16827 16826->16816 16827->16816 16829 7ff6d09f2fce 16828->16829 16830 7ff6d09f2fbe 16828->16830 16831 7ff6d09f2fd7 16829->16831 16836 7ff6d09f3005 16829->16836 16833 7ff6d09fa814 _invalid_parameter_noinfo 37 API calls 16830->16833 16834 7ff6d09fa814 _invalid_parameter_noinfo 37 API calls 16831->16834 16832 7ff6d09f2ffd 16832->16817 16832->16822 16832->16823 16832->16824 16833->16832 16834->16832 16836->16830 16836->16832 16839 7ff6d09f39a4 16836->16839 16872 7ff6d09f33f0 16836->16872 16909 7ff6d09f2b80 16836->16909 16840 7ff6d09f39e6 16839->16840 16841 7ff6d09f3a57 16839->16841 16842 7ff6d09f3a81 16840->16842 16843 7ff6d09f39ec 16840->16843 16844 7ff6d09f3ab0 16841->16844 16845 7ff6d09f3a5c 16841->16845 16932 7ff6d09f1d54 16842->16932 16846 7ff6d09f3a20 16843->16846 16847 7ff6d09f39f1 16843->16847 16848 7ff6d09f3abf 16844->16848 16850 7ff6d09f3ac7 16844->16850 16854 7ff6d09f3aba 16844->16854 16851 7ff6d09f3a91 16845->16851 16853 7ff6d09f3a5e 16845->16853 16846->16848 16855 7ff6d09f39f7 16846->16855 16847->16850 16847->16855 16870 7ff6d09f3af0 16848->16870 16950 7ff6d09f2164 16848->16950 16946 7ff6d09f46ac 16850->16946 16939 7ff6d09f1944 16851->16939 16852 7ff6d09f3a00 16852->16870 16912 7ff6d09f4158 16852->16912 16853->16852 16861 7ff6d09f3a6d 16853->16861 16854->16842 16854->16848 16855->16852 16859 7ff6d09f3a32 16855->16859 16867 7ff6d09f3a1b 16855->16867 16859->16870 16922 7ff6d09f4494 16859->16922 16861->16842 16862 7ff6d09f3a72 16861->16862 16862->16870 16928 7ff6d09f4558 16862->16928 16864 7ff6d09ec550 _log10_special 8 API calls 16866 7ff6d09f3dea 16864->16866 16866->16836 16867->16870 16871 7ff6d09f3cdc 16867->16871 16957 7ff6d09f47c0 16867->16957 16870->16864 16871->16870 16963 7ff6d09fea08 16871->16963 16873 7ff6d09f3414 16872->16873 16874 7ff6d09f33fe 16872->16874 16877 7ff6d09fa814 _invalid_parameter_noinfo 37 API calls 16873->16877 16898 7ff6d09f3454 16873->16898 16875 7ff6d09f39e6 16874->16875 16876 7ff6d09f3a57 16874->16876 16874->16898 16878 7ff6d09f3a81 16875->16878 16879 7ff6d09f39ec 16875->16879 16880 7ff6d09f3ab0 16876->16880 16881 7ff6d09f3a5c 16876->16881 16877->16898 16886 7ff6d09f1d54 38 API calls 16878->16886 16882 7ff6d09f3a20 16879->16882 16883 7ff6d09f39f1 16879->16883 16887 7ff6d09f3ac7 16880->16887 16890 7ff6d09f3aba 16880->16890 16891 7ff6d09f3abf 16880->16891 16884 7ff6d09f3a91 16881->16884 16885 7ff6d09f3a5e 16881->16885 16888 7ff6d09f39f7 16882->16888 16882->16891 16883->16887 16883->16888 16893 7ff6d09f1944 38 API calls 16884->16893 16889 7ff6d09f3a00 16885->16889 16897 7ff6d09f3a6d 16885->16897 16904 7ff6d09f3a1b 16886->16904 16892 7ff6d09f46ac 45 API calls 16887->16892 16888->16889 16895 7ff6d09f3a32 16888->16895 16888->16904 16894 7ff6d09f4158 47 API calls 16889->16894 16907 7ff6d09f3af0 16889->16907 16890->16878 16890->16891 16896 7ff6d09f2164 38 API calls 16891->16896 16891->16907 16892->16904 16893->16904 16894->16904 16899 7ff6d09f4494 46 API calls 16895->16899 16895->16907 16896->16904 16897->16878 16900 7ff6d09f3a72 16897->16900 16898->16836 16899->16904 16902 7ff6d09f4558 37 API calls 16900->16902 16900->16907 16901 7ff6d09ec550 _log10_special 8 API calls 16903 7ff6d09f3dea 16901->16903 16902->16904 16903->16836 16905 7ff6d09f47c0 45 API calls 16904->16905 16904->16907 16908 7ff6d09f3cdc 16904->16908 16905->16908 16906 7ff6d09fea08 46 API calls 16906->16908 16907->16901 16908->16906 16908->16907 17157 7ff6d09f0fc8 16909->17157 16913 7ff6d09f417e 16912->16913 16975 7ff6d09f0b80 16913->16975 16918 7ff6d09f47c0 45 API calls 16919 7ff6d09f42c3 16918->16919 16919->16919 16920 7ff6d09f47c0 45 API calls 16919->16920 16921 7ff6d09f4351 16919->16921 16920->16921 16921->16867 16924 7ff6d09f44c9 16922->16924 16923 7ff6d09f450e 16923->16867 16924->16923 16925 7ff6d09f44e7 16924->16925 16926 7ff6d09f47c0 45 API calls 16924->16926 16927 7ff6d09fea08 46 API calls 16925->16927 16926->16925 16927->16923 16929 7ff6d09f4579 16928->16929 16930 7ff6d09fa814 _invalid_parameter_noinfo 37 API calls 16929->16930 16931 7ff6d09f45aa 16929->16931 16930->16931 16931->16867 16933 7ff6d09f1d87 16932->16933 16934 7ff6d09f1db6 16933->16934 16936 7ff6d09f1e73 16933->16936 16937 7ff6d09f1df3 16934->16937 17111 7ff6d09f0c28 16934->17111 16938 7ff6d09fa814 _invalid_parameter_noinfo 37 API calls 16936->16938 16937->16867 16938->16937 16940 7ff6d09f1977 16939->16940 16941 7ff6d09f19a6 16940->16941 16944 7ff6d09f1a63 16940->16944 16942 7ff6d09f19e3 16941->16942 16943 7ff6d09f0c28 12 API calls 16941->16943 16942->16867 16943->16942 16945 7ff6d09fa814 _invalid_parameter_noinfo 37 API calls 16944->16945 16945->16942 16947 7ff6d09f46ef 16946->16947 16949 7ff6d09f46f3 __crtLCMapStringW 16947->16949 17119 7ff6d09f4748 16947->17119 16949->16867 16951 7ff6d09f2197 16950->16951 16952 7ff6d09f21c6 16951->16952 16954 7ff6d09f2283 16951->16954 16953 7ff6d09f0c28 12 API calls 16952->16953 16956 7ff6d09f2203 16952->16956 16953->16956 16955 7ff6d09fa814 _invalid_parameter_noinfo 37 API calls 16954->16955 16955->16956 16956->16867 16958 7ff6d09f47d7 16957->16958 17123 7ff6d09fd9b8 16958->17123 16964 7ff6d09fea39 16963->16964 16973 7ff6d09fea47 16963->16973 16965 7ff6d09fea67 16964->16965 16966 7ff6d09f47c0 45 API calls 16964->16966 16964->16973 16967 7ff6d09fea9f 16965->16967 16968 7ff6d09fea78 16965->16968 16966->16965 16970 7ff6d09feb2a 16967->16970 16971 7ff6d09feac9 16967->16971 16967->16973 17147 7ff6d0a000a0 16968->17147 16972 7ff6d09ff8a0 _fread_nolock MultiByteToWideChar 16970->16972 16971->16973 17150 7ff6d09ff8a0 16971->17150 16972->16973 16973->16871 16976 7ff6d09f0ba6 16975->16976 16977 7ff6d09f0bb7 16975->16977 16983 7ff6d09fe570 16976->16983 16977->16976 16978 7ff6d09fd5fc _fread_nolock 12 API calls 16977->16978 16979 7ff6d09f0be4 16978->16979 16980 7ff6d09f0bf8 16979->16980 16981 7ff6d09fa948 __free_lconv_num 11 API calls 16979->16981 16982 7ff6d09fa948 __free_lconv_num 11 API calls 16980->16982 16981->16980 16982->16976 16984 7ff6d09fe5c0 16983->16984 16985 7ff6d09fe58d 16983->16985 16984->16985 16987 7ff6d09fe5f2 16984->16987 16986 7ff6d09fa814 _invalid_parameter_noinfo 37 API calls 16985->16986 16996 7ff6d09f42a1 16986->16996 16993 7ff6d09fe705 16987->16993 16998 7ff6d09fe63a 16987->16998 16988 7ff6d09fe7f7 17038 7ff6d09fda5c 16988->17038 16990 7ff6d09fe7bd 17031 7ff6d09fddf4 16990->17031 16992 7ff6d09fe78c 17024 7ff6d09fe0d4 16992->17024 16993->16988 16993->16990 16993->16992 16995 7ff6d09fe74f 16993->16995 16997 7ff6d09fe745 16993->16997 17014 7ff6d09fe304 16995->17014 16996->16918 16996->16919 16997->16990 17000 7ff6d09fe74a 16997->17000 16998->16996 17005 7ff6d09fa4a4 16998->17005 17000->16992 17000->16995 17003 7ff6d09fa900 _isindst 17 API calls 17004 7ff6d09fe854 17003->17004 17006 7ff6d09fa4b1 17005->17006 17007 7ff6d09fa4bb 17005->17007 17006->17007 17009 7ff6d09fa4d6 17006->17009 17008 7ff6d09f4f08 memcpy_s 11 API calls 17007->17008 17013 7ff6d09fa4c2 17008->17013 17011 7ff6d09fa4ce 17009->17011 17012 7ff6d09f4f08 memcpy_s 11 API calls 17009->17012 17010 7ff6d09fa8e0 _invalid_parameter_noinfo 37 API calls 17010->17011 17011->16996 17011->17003 17012->17013 17013->17010 17047 7ff6d0a040ac 17014->17047 17018 7ff6d09fe3ac 17019 7ff6d09fe3b0 17018->17019 17020 7ff6d09fe401 17018->17020 17021 7ff6d09fe3cc 17018->17021 17019->16996 17100 7ff6d09fdef0 17020->17100 17096 7ff6d09fe1ac 17021->17096 17025 7ff6d0a040ac 38 API calls 17024->17025 17026 7ff6d09fe11e 17025->17026 17027 7ff6d0a03af4 37 API calls 17026->17027 17028 7ff6d09fe16e 17027->17028 17029 7ff6d09fe172 17028->17029 17030 7ff6d09fe1ac 45 API calls 17028->17030 17029->16996 17030->17029 17032 7ff6d0a040ac 38 API calls 17031->17032 17033 7ff6d09fde3f 17032->17033 17034 7ff6d0a03af4 37 API calls 17033->17034 17035 7ff6d09fde97 17034->17035 17036 7ff6d09fde9b 17035->17036 17037 7ff6d09fdef0 45 API calls 17035->17037 17036->16996 17037->17036 17039 7ff6d09fdad4 17038->17039 17040 7ff6d09fdaa1 17038->17040 17041 7ff6d09fdaec 17039->17041 17044 7ff6d09fdb6d 17039->17044 17042 7ff6d09fa814 _invalid_parameter_noinfo 37 API calls 17040->17042 17043 7ff6d09fddf4 46 API calls 17041->17043 17046 7ff6d09fdacd memcpy_s 17042->17046 17043->17046 17045 7ff6d09f47c0 45 API calls 17044->17045 17044->17046 17045->17046 17046->16996 17048 7ff6d0a040ff fegetenv 17047->17048 17049 7ff6d0a07e2c 37 API calls 17048->17049 17053 7ff6d0a04152 17049->17053 17050 7ff6d0a0417f 17055 7ff6d09fa4a4 __std_exception_copy 37 API calls 17050->17055 17051 7ff6d0a04242 17052 7ff6d0a07e2c 37 API calls 17051->17052 17054 7ff6d0a0426c 17052->17054 17053->17051 17056 7ff6d0a0421c 17053->17056 17057 7ff6d0a0416d 17053->17057 17058 7ff6d0a07e2c 37 API calls 17054->17058 17059 7ff6d0a041fd 17055->17059 17062 7ff6d09fa4a4 __std_exception_copy 37 API calls 17056->17062 17057->17050 17057->17051 17060 7ff6d0a0427d 17058->17060 17061 7ff6d0a05324 17059->17061 17066 7ff6d0a04205 17059->17066 17063 7ff6d0a08020 20 API calls 17060->17063 17064 7ff6d09fa900 _isindst 17 API calls 17061->17064 17062->17059 17077 7ff6d0a042e6 memcpy_s 17063->17077 17065 7ff6d0a05339 17064->17065 17067 7ff6d09ec550 _log10_special 8 API calls 17066->17067 17068 7ff6d09fe351 17067->17068 17092 7ff6d0a03af4 17068->17092 17069 7ff6d0a0468f memcpy_s 17070 7ff6d0a049cf 17073 7ff6d0a03c10 37 API calls 17070->17073 17071 7ff6d0a04c6b memcpy_s 17071->17070 17074 7ff6d0a0497b 17071->17074 17087 7ff6d09f4f08 11 API calls memcpy_s 17071->17087 17091 7ff6d09fa8e0 37 API calls _invalid_parameter_noinfo 17071->17091 17072 7ff6d0a04783 memcpy_s 17072->17074 17086 7ff6d09f4f08 11 API calls memcpy_s 17072->17086 17089 7ff6d09fa8e0 37 API calls _invalid_parameter_noinfo 17072->17089 17079 7ff6d0a050e7 17073->17079 17074->17070 17074->17074 17078 7ff6d0a0533c memcpy_s 37 API calls 17074->17078 17075 7ff6d0a05142 17082 7ff6d0a052c8 17075->17082 17088 7ff6d0a03c10 37 API calls 17075->17088 17090 7ff6d0a0533c memcpy_s 37 API calls 17075->17090 17076 7ff6d0a04327 memcpy_s 17076->17071 17076->17072 17077->17069 17077->17076 17080 7ff6d09f4f08 memcpy_s 11 API calls 17077->17080 17078->17070 17079->17075 17079->17079 17084 7ff6d0a0533c memcpy_s 37 API calls 17079->17084 17081 7ff6d0a04760 17080->17081 17083 7ff6d09fa8e0 _invalid_parameter_noinfo 37 API calls 17081->17083 17085 7ff6d0a07e2c 37 API calls 17082->17085 17083->17076 17084->17075 17085->17066 17086->17072 17087->17071 17088->17075 17089->17072 17090->17075 17091->17071 17093 7ff6d0a03b13 17092->17093 17094 7ff6d09fa814 _invalid_parameter_noinfo 37 API calls 17093->17094 17095 7ff6d0a03b3e memcpy_s 17093->17095 17094->17095 17095->17018 17097 7ff6d09fe1d8 memcpy_s 17096->17097 17098 7ff6d09f47c0 45 API calls 17097->17098 17099 7ff6d09fe292 memcpy_s 17097->17099 17098->17099 17099->17019 17101 7ff6d09fdf2b 17100->17101 17104 7ff6d09fdf78 memcpy_s 17100->17104 17102 7ff6d09fa814 _invalid_parameter_noinfo 37 API calls 17101->17102 17103 7ff6d09fdf57 17102->17103 17103->17019 17105 7ff6d09fdfe3 17104->17105 17107 7ff6d09f47c0 45 API calls 17104->17107 17106 7ff6d09fa4a4 __std_exception_copy 37 API calls 17105->17106 17110 7ff6d09fe025 memcpy_s 17106->17110 17107->17105 17108 7ff6d09fa900 _isindst 17 API calls 17109 7ff6d09fe0d0 17108->17109 17110->17108 17112 7ff6d09f0c4e 17111->17112 17113 7ff6d09f0c5f 17111->17113 17112->16937 17113->17112 17114 7ff6d09fd5fc _fread_nolock 12 API calls 17113->17114 17115 7ff6d09f0c90 17114->17115 17116 7ff6d09f0ca4 17115->17116 17118 7ff6d09fa948 __free_lconv_num 11 API calls 17115->17118 17117 7ff6d09fa948 __free_lconv_num 11 API calls 17116->17117 17117->17112 17118->17116 17120 7ff6d09f476e 17119->17120 17121 7ff6d09f4766 17119->17121 17120->16949 17122 7ff6d09f47c0 45 API calls 17121->17122 17122->17120 17124 7ff6d09fd9d1 17123->17124 17125 7ff6d09f47ff 17123->17125 17124->17125 17131 7ff6d0a03304 17124->17131 17127 7ff6d09fda24 17125->17127 17128 7ff6d09f480f 17127->17128 17129 7ff6d09fda3d 17127->17129 17128->16871 17129->17128 17144 7ff6d0a02650 17129->17144 17132 7ff6d09fb150 _CallSETranslator 45 API calls 17131->17132 17133 7ff6d0a03313 17132->17133 17134 7ff6d0a0335e 17133->17134 17143 7ff6d0a002d8 EnterCriticalSection 17133->17143 17134->17125 17145 7ff6d09fb150 _CallSETranslator 45 API calls 17144->17145 17146 7ff6d0a02659 17145->17146 17153 7ff6d0a06d88 17147->17153 17152 7ff6d09ff8a9 MultiByteToWideChar 17150->17152 17156 7ff6d0a06dec 17153->17156 17154 7ff6d09ec550 _log10_special 8 API calls 17155 7ff6d0a000bd 17154->17155 17155->16973 17156->17154 17158 7ff6d09f100f 17157->17158 17159 7ff6d09f0ffd 17157->17159 17162 7ff6d09f101d 17158->17162 17166 7ff6d09f1059 17158->17166 17160 7ff6d09f4f08 memcpy_s 11 API calls 17159->17160 17161 7ff6d09f1002 17160->17161 17163 7ff6d09fa8e0 _invalid_parameter_noinfo 37 API calls 17161->17163 17164 7ff6d09fa814 _invalid_parameter_noinfo 37 API calls 17162->17164 17165 7ff6d09f100d 17163->17165 17164->17165 17165->16836 17167 7ff6d09f13d5 17166->17167 17169 7ff6d09f4f08 memcpy_s 11 API calls 17166->17169 17167->17165 17168 7ff6d09f4f08 memcpy_s 11 API calls 17167->17168 17170 7ff6d09f1669 17168->17170 17171 7ff6d09f13ca 17169->17171 17172 7ff6d09fa8e0 _invalid_parameter_noinfo 37 API calls 17170->17172 17173 7ff6d09fa8e0 _invalid_parameter_noinfo 37 API calls 17171->17173 17172->17165 17173->17167 17175 7ff6d09f0704 17174->17175 17202 7ff6d09f0464 17175->17202 17177 7ff6d09f071d 17177->16489 17214 7ff6d09f03bc 17178->17214 17182 7ff6d09ec850 17181->17182 17183 7ff6d09e2930 GetCurrentProcessId 17182->17183 17184 7ff6d09e1c80 49 API calls 17183->17184 17185 7ff6d09e2979 17184->17185 17228 7ff6d09f4984 17185->17228 17190 7ff6d09e1c80 49 API calls 17191 7ff6d09e29ff 17190->17191 17258 7ff6d09e2620 17191->17258 17194 7ff6d09ec550 _log10_special 8 API calls 17195 7ff6d09e2a31 17194->17195 17195->16528 17197 7ff6d09e1b89 17196->17197 17198 7ff6d09f0119 17196->17198 17197->16527 17197->16528 17199 7ff6d09f4f08 memcpy_s 11 API calls 17198->17199 17200 7ff6d09f011e 17199->17200 17201 7ff6d09fa8e0 _invalid_parameter_noinfo 37 API calls 17200->17201 17201->17197 17203 7ff6d09f04ce 17202->17203 17204 7ff6d09f048e 17202->17204 17203->17204 17206 7ff6d09f04da 17203->17206 17205 7ff6d09fa814 _invalid_parameter_noinfo 37 API calls 17204->17205 17207 7ff6d09f04b5 17205->17207 17213 7ff6d09f546c EnterCriticalSection 17206->17213 17207->17177 17215 7ff6d09e1a20 17214->17215 17216 7ff6d09f03e6 17214->17216 17215->16496 17215->16497 17216->17215 17217 7ff6d09f03f5 memcpy_s 17216->17217 17218 7ff6d09f0432 17216->17218 17221 7ff6d09f4f08 memcpy_s 11 API calls 17217->17221 17227 7ff6d09f546c EnterCriticalSection 17218->17227 17222 7ff6d09f040a 17221->17222 17224 7ff6d09fa8e0 _invalid_parameter_noinfo 37 API calls 17222->17224 17224->17215 17231 7ff6d09f49de 17228->17231 17229 7ff6d09f4a03 17232 7ff6d09fa814 _invalid_parameter_noinfo 37 API calls 17229->17232 17230 7ff6d09f4a3f 17267 7ff6d09f2c10 17230->17267 17231->17229 17231->17230 17234 7ff6d09f4a2d 17232->17234 17235 7ff6d09ec550 _log10_special 8 API calls 17234->17235 17238 7ff6d09e29c3 17235->17238 17236 7ff6d09fa948 __free_lconv_num 11 API calls 17236->17234 17246 7ff6d09f5160 17238->17246 17239 7ff6d09f4b40 17241 7ff6d09f4b4a 17239->17241 17244 7ff6d09f4b1c 17239->17244 17240 7ff6d09f4af1 17242 7ff6d09fa948 __free_lconv_num 11 API calls 17240->17242 17245 7ff6d09fa948 __free_lconv_num 11 API calls 17241->17245 17242->17234 17243 7ff6d09f4ae8 17243->17240 17243->17244 17244->17236 17245->17234 17247 7ff6d09fb2c8 memcpy_s 11 API calls 17246->17247 17248 7ff6d09f5177 17247->17248 17249 7ff6d09e29e5 17248->17249 17250 7ff6d09feb98 memcpy_s 11 API calls 17248->17250 17252 7ff6d09f51b7 17248->17252 17249->17190 17251 7ff6d09f51ac 17250->17251 17253 7ff6d09fa948 __free_lconv_num 11 API calls 17251->17253 17252->17249 17405 7ff6d09fec20 17252->17405 17253->17252 17256 7ff6d09fa900 _isindst 17 API calls 17257 7ff6d09f51fc 17256->17257 17259 7ff6d09e262f 17258->17259 17260 7ff6d09e9390 2 API calls 17259->17260 17261 7ff6d09e2660 17260->17261 17262 7ff6d09e2683 MessageBoxA 17261->17262 17263 7ff6d09e266f MessageBoxW 17261->17263 17264 7ff6d09e2690 17262->17264 17263->17264 17265 7ff6d09ec550 _log10_special 8 API calls 17264->17265 17266 7ff6d09e26a0 17265->17266 17266->17194 17268 7ff6d09f2c4e 17267->17268 17269 7ff6d09f2c3e 17267->17269 17270 7ff6d09f2c57 17268->17270 17275 7ff6d09f2c85 17268->17275 17273 7ff6d09fa814 _invalid_parameter_noinfo 37 API calls 17269->17273 17271 7ff6d09fa814 _invalid_parameter_noinfo 37 API calls 17270->17271 17272 7ff6d09f2c7d 17271->17272 17272->17239 17272->17240 17272->17243 17272->17244 17273->17272 17274 7ff6d09f47c0 45 API calls 17274->17275 17275->17269 17275->17272 17275->17274 17276 7ff6d09f2f34 17275->17276 17281 7ff6d09f35a0 17275->17281 17307 7ff6d09f3268 17275->17307 17337 7ff6d09f2af0 17275->17337 17279 7ff6d09fa814 _invalid_parameter_noinfo 37 API calls 17276->17279 17279->17269 17282 7ff6d09f3655 17281->17282 17283 7ff6d09f35e2 17281->17283 17286 7ff6d09f36af 17282->17286 17287 7ff6d09f365a 17282->17287 17284 7ff6d09f367f 17283->17284 17285 7ff6d09f35e8 17283->17285 17354 7ff6d09f1b50 17284->17354 17294 7ff6d09f35ed 17285->17294 17298 7ff6d09f36be 17285->17298 17286->17284 17286->17298 17305 7ff6d09f3618 17286->17305 17288 7ff6d09f368f 17287->17288 17289 7ff6d09f365c 17287->17289 17361 7ff6d09f1740 17288->17361 17291 7ff6d09f35fd 17289->17291 17297 7ff6d09f366b 17289->17297 17306 7ff6d09f36ed 17291->17306 17340 7ff6d09f3f04 17291->17340 17294->17291 17296 7ff6d09f3630 17294->17296 17294->17305 17296->17306 17350 7ff6d09f43c0 17296->17350 17297->17284 17300 7ff6d09f3670 17297->17300 17298->17306 17368 7ff6d09f1f60 17298->17368 17302 7ff6d09f4558 37 API calls 17300->17302 17300->17306 17301 7ff6d09ec550 _log10_special 8 API calls 17303 7ff6d09f3983 17301->17303 17302->17305 17303->17275 17305->17306 17375 7ff6d09fe858 17305->17375 17306->17301 17308 7ff6d09f3273 17307->17308 17309 7ff6d09f3289 17307->17309 17310 7ff6d09f3655 17308->17310 17311 7ff6d09f35e2 17308->17311 17313 7ff6d09f32c7 17308->17313 17312 7ff6d09fa814 _invalid_parameter_noinfo 37 API calls 17309->17312 17309->17313 17316 7ff6d09f36af 17310->17316 17317 7ff6d09f365a 17310->17317 17314 7ff6d09f367f 17311->17314 17315 7ff6d09f35e8 17311->17315 17312->17313 17313->17275 17320 7ff6d09f1b50 38 API calls 17314->17320 17324 7ff6d09f35ed 17315->17324 17326 7ff6d09f36be 17315->17326 17316->17314 17316->17326 17335 7ff6d09f3618 17316->17335 17318 7ff6d09f368f 17317->17318 17319 7ff6d09f365c 17317->17319 17322 7ff6d09f1740 38 API calls 17318->17322 17321 7ff6d09f35fd 17319->17321 17328 7ff6d09f366b 17319->17328 17320->17335 17323 7ff6d09f3f04 47 API calls 17321->17323 17336 7ff6d09f36ed 17321->17336 17322->17335 17323->17335 17324->17321 17325 7ff6d09f3630 17324->17325 17324->17335 17329 7ff6d09f43c0 47 API calls 17325->17329 17325->17336 17327 7ff6d09f1f60 38 API calls 17326->17327 17326->17336 17327->17335 17328->17314 17330 7ff6d09f3670 17328->17330 17329->17335 17332 7ff6d09f4558 37 API calls 17330->17332 17330->17336 17331 7ff6d09ec550 _log10_special 8 API calls 17333 7ff6d09f3983 17331->17333 17332->17335 17333->17275 17334 7ff6d09fe858 47 API calls 17334->17335 17335->17334 17335->17336 17336->17331 17388 7ff6d09f0d14 17337->17388 17341 7ff6d09f3f26 17340->17341 17342 7ff6d09f0b80 12 API calls 17341->17342 17343 7ff6d09f3f6e 17342->17343 17344 7ff6d09fe570 46 API calls 17343->17344 17345 7ff6d09f4041 17344->17345 17346 7ff6d09f4063 17345->17346 17347 7ff6d09f47c0 45 API calls 17345->17347 17348 7ff6d09f47c0 45 API calls 17346->17348 17349 7ff6d09f40ec 17346->17349 17347->17346 17348->17349 17349->17305 17351 7ff6d09f43d8 17350->17351 17353 7ff6d09f4440 17350->17353 17352 7ff6d09fe858 47 API calls 17351->17352 17351->17353 17352->17353 17353->17305 17355 7ff6d09f1b83 17354->17355 17356 7ff6d09f1bb2 17355->17356 17358 7ff6d09f1c6f 17355->17358 17357 7ff6d09f0b80 12 API calls 17356->17357 17360 7ff6d09f1bef 17356->17360 17357->17360 17359 7ff6d09fa814 _invalid_parameter_noinfo 37 API calls 17358->17359 17359->17360 17360->17305 17362 7ff6d09f1773 17361->17362 17363 7ff6d09f17a2 17362->17363 17365 7ff6d09f185f 17362->17365 17364 7ff6d09f0b80 12 API calls 17363->17364 17367 7ff6d09f17df 17363->17367 17364->17367 17366 7ff6d09fa814 _invalid_parameter_noinfo 37 API calls 17365->17366 17366->17367 17367->17305 17369 7ff6d09f1f93 17368->17369 17370 7ff6d09f1fc2 17369->17370 17372 7ff6d09f207f 17369->17372 17371 7ff6d09f0b80 12 API calls 17370->17371 17374 7ff6d09f1fff 17370->17374 17371->17374 17373 7ff6d09fa814 _invalid_parameter_noinfo 37 API calls 17372->17373 17373->17374 17374->17305 17376 7ff6d09fe880 17375->17376 17377 7ff6d09fe8c5 17376->17377 17378 7ff6d09f47c0 45 API calls 17376->17378 17379 7ff6d09fe885 memcpy_s 17376->17379 17381 7ff6d09fe8ae memcpy_s 17376->17381 17377->17379 17377->17381 17385 7ff6d0a007e8 17377->17385 17378->17377 17379->17305 17380 7ff6d09fa814 _invalid_parameter_noinfo 37 API calls 17380->17379 17381->17379 17381->17380 17387 7ff6d0a0080c WideCharToMultiByte 17385->17387 17389 7ff6d09f0d53 17388->17389 17390 7ff6d09f0d41 17388->17390 17392 7ff6d09f0d9d 17389->17392 17394 7ff6d09f0d60 17389->17394 17391 7ff6d09f4f08 memcpy_s 11 API calls 17390->17391 17393 7ff6d09f0d46 17391->17393 17397 7ff6d09f0e46 17392->17397 17398 7ff6d09f4f08 memcpy_s 11 API calls 17392->17398 17396 7ff6d09fa8e0 _invalid_parameter_noinfo 37 API calls 17393->17396 17395 7ff6d09fa814 _invalid_parameter_noinfo 37 API calls 17394->17395 17400 7ff6d09f0d51 17395->17400 17396->17400 17399 7ff6d09f4f08 memcpy_s 11 API calls 17397->17399 17397->17400 17401 7ff6d09f0e3b 17398->17401 17402 7ff6d09f0ef0 17399->17402 17400->17275 17403 7ff6d09fa8e0 _invalid_parameter_noinfo 37 API calls 17401->17403 17404 7ff6d09fa8e0 _invalid_parameter_noinfo 37 API calls 17402->17404 17403->17397 17404->17400 17409 7ff6d09fec3d 17405->17409 17406 7ff6d09fec42 17407 7ff6d09f51dd 17406->17407 17408 7ff6d09f4f08 memcpy_s 11 API calls 17406->17408 17407->17249 17407->17256 17410 7ff6d09fec4c 17408->17410 17409->17406 17409->17407 17412 7ff6d09fec8c 17409->17412 17411 7ff6d09fa8e0 _invalid_parameter_noinfo 37 API calls 17410->17411 17411->17407 17412->17407 17413 7ff6d09f4f08 memcpy_s 11 API calls 17412->17413 17413->17410 17415 7ff6d09e85b1 GetTokenInformation 17414->17415 17418 7ff6d09e8633 __std_exception_destroy 17414->17418 17416 7ff6d09e85d2 GetLastError 17415->17416 17417 7ff6d09e85dd 17415->17417 17416->17417 17416->17418 17417->17418 17421 7ff6d09e85f9 GetTokenInformation 17417->17421 17419 7ff6d09e864c 17418->17419 17420 7ff6d09e8646 CloseHandle 17418->17420 17419->16546 17420->17419 17421->17418 17422 7ff6d09e861c 17421->17422 17422->17418 17423 7ff6d09e8626 ConvertSidToStringSidW 17422->17423 17423->17418 17425 7ff6d09ec850 17424->17425 17426 7ff6d09e2b74 GetCurrentProcessId 17425->17426 17427 7ff6d09e26b0 48 API calls 17426->17427 17428 7ff6d09e2bc7 17427->17428 17429 7ff6d09f4bd8 48 API calls 17428->17429 17430 7ff6d09e2c10 MessageBoxW 17429->17430 17431 7ff6d09ec550 _log10_special 8 API calls 17430->17431 17432 7ff6d09e2c40 17431->17432 17432->16557 17434 7ff6d09e25e5 17433->17434 17435 7ff6d09f4bd8 48 API calls 17434->17435 17436 7ff6d09e2604 17435->17436 17436->16571 17482 7ff6d09f8794 17437->17482 17441 7ff6d09e81dc 17440->17441 17442 7ff6d09e9390 2 API calls 17441->17442 17443 7ff6d09e81fb 17442->17443 17444 7ff6d09e8203 17443->17444 17445 7ff6d09e8216 ExpandEnvironmentStringsW 17443->17445 17446 7ff6d09e2810 49 API calls 17444->17446 17447 7ff6d09e823c __std_exception_destroy 17445->17447 17452 7ff6d09e820f __std_exception_destroy 17446->17452 17448 7ff6d09e8253 17447->17448 17449 7ff6d09e8240 17447->17449 17454 7ff6d09e8261 GetDriveTypeW 17448->17454 17455 7ff6d09e82bf 17448->17455 17450 7ff6d09e2810 49 API calls 17449->17450 17450->17452 17451 7ff6d09ec550 _log10_special 8 API calls 17453 7ff6d09e83af 17451->17453 17452->17451 17458 7ff6d09e8295 17454->17458 17459 7ff6d09e82b0 17454->17459 17620 7ff6d09f7e08 17455->17620 17523 7ff6d0a01558 17482->17523 17582 7ff6d0a012d0 17523->17582 17603 7ff6d0a002d8 EnterCriticalSection 17582->17603 17621 7ff6d09f7e24 17620->17621 17622 7ff6d09f7e92 17620->17622 17621->17622 17730 7ff6d09e456a 17729->17730 17731 7ff6d09e9390 2 API calls 17730->17731 17732 7ff6d09e458f 17731->17732 17733 7ff6d09ec550 _log10_special 8 API calls 17732->17733 17734 7ff6d09e45b7 17733->17734 17734->16608 17736 7ff6d09e7e2e 17735->17736 17737 7ff6d09e7f52 17736->17737 17738 7ff6d09e1c80 49 API calls 17736->17738 17739 7ff6d09ec550 _log10_special 8 API calls 17737->17739 17743 7ff6d09e7eb5 17738->17743 17740 7ff6d09e7f83 17739->17740 17740->16608 17741 7ff6d09e1c80 49 API calls 17741->17743 17742 7ff6d09e4560 10 API calls 17742->17743 17743->17737 17743->17741 17743->17742 17744 7ff6d09e9390 2 API calls 17743->17744 17745 7ff6d09e7f23 CreateDirectoryW 17744->17745 17745->17737 17745->17743 17747 7ff6d09e1613 17746->17747 17748 7ff6d09e1637 17746->17748 17867 7ff6d09e1050 17747->17867 17750 7ff6d09e45c0 108 API calls 17748->17750 17752 7ff6d09e164b 17750->17752 17751 7ff6d09e1618 17753 7ff6d09e162e 17751->17753 17757 7ff6d09e2710 54 API calls 17751->17757 17754 7ff6d09e1653 17752->17754 17755 7ff6d09e1682 17752->17755 17753->16608 17758 7ff6d09f4f08 memcpy_s 11 API calls 17754->17758 17756 7ff6d09e45c0 108 API calls 17755->17756 17759 7ff6d09e1696 17756->17759 17757->17753 17760 7ff6d09e1658 17758->17760 17761 7ff6d09e169e 17759->17761 17762 7ff6d09e16b8 17759->17762 17763 7ff6d09e2910 54 API calls 17760->17763 17764 7ff6d09e2710 54 API calls 17761->17764 17765 7ff6d09f06d4 73 API calls 17762->17765 17766 7ff6d09e1671 17763->17766 17767 7ff6d09e16ae 17764->17767 17768 7ff6d09e16cd 17765->17768 17766->16608 17771 7ff6d09f004c 74 API calls 17767->17771 17769 7ff6d09e16d1 17768->17769 17770 7ff6d09e16f9 17768->17770 17772 7ff6d09f4f08 memcpy_s 11 API calls 17769->17772 17773 7ff6d09e16ff 17770->17773 17774 7ff6d09e1717 17770->17774 17775 7ff6d09e1829 17771->17775 17776 7ff6d09e16d6 17772->17776 17775->16608 17795 7ff6d09e718b 17794->17795 17797 7ff6d09e7144 17794->17797 17795->16608 17797->17795 17931 7ff6d09f5024 17797->17931 17799 7ff6d09e41a1 17798->17799 17800 7ff6d09e44e0 49 API calls 17799->17800 17801 7ff6d09e41db 17800->17801 17802 7ff6d09e44e0 49 API calls 17801->17802 17803 7ff6d09e41eb 17802->17803 17804 7ff6d09e420d 17803->17804 17805 7ff6d09e423c 17803->17805 17962 7ff6d09e4110 17804->17962 17807 7ff6d09e4110 51 API calls 17805->17807 17808 7ff6d09e423a 17807->17808 17809 7ff6d09e429c 17808->17809 17810 7ff6d09e4267 17808->17810 17811 7ff6d09e4110 51 API calls 17809->17811 17969 7ff6d09e7cf0 17810->17969 17813 7ff6d09e42c0 17811->17813 17816 7ff6d09e4110 51 API calls 17813->17816 17824 7ff6d09e4312 17813->17824 17843 7ff6d09e1c80 49 API calls 17842->17843 17844 7ff6d09e4474 17843->17844 17844->16608 17868 7ff6d09e45c0 108 API calls 17867->17868 17869 7ff6d09e108c 17868->17869 17870 7ff6d09e1094 17869->17870 17871 7ff6d09e10a9 17869->17871 17872 7ff6d09e2710 54 API calls 17870->17872 17873 7ff6d09f06d4 73 API calls 17871->17873 17879 7ff6d09e10a4 __std_exception_destroy 17872->17879 17874 7ff6d09e10bf 17873->17874 17875 7ff6d09e10c3 17874->17875 17876 7ff6d09e10e6 17874->17876 17877 7ff6d09f4f08 memcpy_s 11 API calls 17875->17877 17880 7ff6d09e1122 17876->17880 17881 7ff6d09e10f7 17876->17881 17878 7ff6d09e10c8 17877->17878 17882 7ff6d09e2910 54 API calls 17878->17882 17879->17751 17884 7ff6d09e113c 17880->17884 17885 7ff6d09e1129 17880->17885 17883 7ff6d09f4f08 memcpy_s 11 API calls 17881->17883 17886 7ff6d09e10e1 __std_exception_destroy 17882->17886 17887 7ff6d09e1100 17883->17887 17884->17886 17891 7ff6d09f039c _fread_nolock 53 API calls 17884->17891 17894 7ff6d09e11ed 17884->17894 17888 7ff6d09e1210 92 API calls 17885->17888 17890 7ff6d09f004c 74 API calls 17886->17890 17889 7ff6d09e2910 54 API calls 17887->17889 17888->17886 17889->17886 17891->17884 17895 7ff6d09f4f08 memcpy_s 11 API calls 17894->17895 17932 7ff6d09f5031 17931->17932 17933 7ff6d09f505e 17931->17933 17935 7ff6d09f4f08 memcpy_s 11 API calls 17932->17935 17943 7ff6d09f4fe8 17932->17943 17934 7ff6d09f5081 17933->17934 17937 7ff6d09f509d 17933->17937 17936 7ff6d09f4f08 memcpy_s 11 API calls 17934->17936 17938 7ff6d09f503b 17935->17938 17940 7ff6d09f5086 17936->17940 17946 7ff6d09f4f4c 17937->17946 17939 7ff6d09fa8e0 _invalid_parameter_noinfo 37 API calls 17938->17939 17942 7ff6d09f5046 17939->17942 17944 7ff6d09fa8e0 _invalid_parameter_noinfo 37 API calls 17940->17944 17942->17797 17943->17797 17945 7ff6d09f5091 17944->17945 17945->17797 17947 7ff6d09f4f70 17946->17947 17948 7ff6d09f4f6b 17946->17948 17947->17948 17949 7ff6d09fb150 _CallSETranslator 45 API calls 17947->17949 17948->17945 17950 7ff6d09f4f8b 17949->17950 17954 7ff6d09fd984 17950->17954 17955 7ff6d09fd999 17954->17955 17957 7ff6d09f4fae 17954->17957 17956 7ff6d0a03304 45 API calls 17955->17956 17955->17957 17956->17957 17958 7ff6d09fd9f0 17957->17958 17959 7ff6d09fda18 17958->17959 17960 7ff6d09fda05 17958->17960 17959->17948 17960->17959 17963 7ff6d09e4136 17962->17963 17964 7ff6d09f4984 49 API calls 17963->17964 17965 7ff6d09e415c 17964->17965 17966 7ff6d09e416d 17965->17966 17967 7ff6d09e4560 10 API calls 17965->17967 17966->17808 17970 7ff6d09e7d05 17969->17970 18026 7ff6d09f5ec8 18025->18026 18027 7ff6d09f5eee 18026->18027 18030 7ff6d09f5f21 18026->18030 18028 7ff6d09f4f08 memcpy_s 11 API calls 18027->18028 18029 7ff6d09f5ef3 18028->18029 18031 7ff6d09fa8e0 _invalid_parameter_noinfo 37 API calls 18029->18031 18032 7ff6d09f5f34 18030->18032 18033 7ff6d09f5f27 18030->18033 18043 7ff6d09e4616 18031->18043 18044 7ff6d09fac28 18032->18044 18034 7ff6d09f4f08 memcpy_s 11 API calls 18033->18034 18034->18043 18043->16634 18057 7ff6d0a002d8 EnterCriticalSection 18044->18057 18417 7ff6d09f78f8 18416->18417 18420 7ff6d09f73d4 18417->18420 18419 7ff6d09f7911 18419->16644 18421 7ff6d09f741e 18420->18421 18422 7ff6d09f73ef 18420->18422 18430 7ff6d09f546c EnterCriticalSection 18421->18430 18423 7ff6d09fa814 _invalid_parameter_noinfo 37 API calls 18422->18423 18429 7ff6d09f740f 18423->18429 18429->18419 18432 7ff6d09efe43 18431->18432 18433 7ff6d09efe71 18431->18433 18434 7ff6d09fa814 _invalid_parameter_noinfo 37 API calls 18432->18434 18437 7ff6d09efe63 18433->18437 18441 7ff6d09f546c EnterCriticalSection 18433->18441 18434->18437 18437->16648 18443 7ff6d09e45c0 108 API calls 18442->18443 18444 7ff6d09e1493 18443->18444 18445 7ff6d09e149b 18444->18445 18446 7ff6d09e14bc 18444->18446 18447 7ff6d09e2710 54 API calls 18445->18447 18448 7ff6d09f06d4 73 API calls 18446->18448 18449 7ff6d09e14ab 18447->18449 18450 7ff6d09e14d1 18448->18450 18449->16681 18451 7ff6d09e14d5 18450->18451 18452 7ff6d09e14f8 18450->18452 18453 7ff6d09f4f08 memcpy_s 11 API calls 18451->18453 18455 7ff6d09e1532 18452->18455 18456 7ff6d09e1508 18452->18456 18454 7ff6d09e14da 18453->18454 18459 7ff6d09e1538 18455->18459 18467 7ff6d09e154b 18455->18467 18458 7ff6d09f4f08 memcpy_s 11 API calls 18456->18458 18549 7ff6d09e6375 18548->18549 18550 7ff6d09e1c80 49 API calls 18549->18550 18551 7ff6d09e63b1 18550->18551 18552 7ff6d09e63ba 18551->18552 18553 7ff6d09e63dd 18551->18553 18554 7ff6d09e2710 54 API calls 18552->18554 18555 7ff6d09e4630 49 API calls 18553->18555 18578 7ff6d09e63d3 18554->18578 18556 7ff6d09e63f5 18555->18556 18557 7ff6d09e6413 18556->18557 18559 7ff6d09e2710 54 API calls 18556->18559 18560 7ff6d09e4560 10 API calls 18557->18560 18558 7ff6d09ec550 _log10_special 8 API calls 18561 7ff6d09e336e 18558->18561 18559->18557 18562 7ff6d09e641d 18560->18562 18561->16755 18579 7ff6d09e6500 18561->18579 18563 7ff6d09e642b 18562->18563 18565 7ff6d09e8e80 3 API calls 18562->18565 18564 7ff6d09e4630 49 API calls 18563->18564 18566 7ff6d09e6444 18564->18566 18565->18563 18578->18558 18728 7ff6d09e5400 18579->18728 18730 7ff6d09e542c 18728->18730 18729 7ff6d09e5434 18730->18729 18733 7ff6d09e55d4 18730->18733 18759 7ff6d09f6aa4 18730->18759 19940 7ff6d09ecb50 19941 7ff6d09ecb60 19940->19941 19957 7ff6d09f9ba8 19941->19957 19943 7ff6d09ecb6c 19963 7ff6d09ece48 19943->19963 19945 7ff6d09ed12c 7 API calls 19947 7ff6d09ecc05 19945->19947 19946 7ff6d09ecb84 _RTC_Initialize 19955 7ff6d09ecbd9 19946->19955 19968 7ff6d09ecff8 19946->19968 19949 7ff6d09ecb99 19971 7ff6d09f9014 19949->19971 19955->19945 19956 7ff6d09ecbf5 19955->19956 19958 7ff6d09f9bb9 19957->19958 19959 7ff6d09f9bc1 19958->19959 19960 7ff6d09f4f08 memcpy_s 11 API calls 19958->19960 19959->19943 19961 7ff6d09f9bd0 19960->19961 19962 7ff6d09fa8e0 _invalid_parameter_noinfo 37 API calls 19961->19962 19962->19959 19964 7ff6d09ece59 19963->19964 19967 7ff6d09ece5e __scrt_acquire_startup_lock 19963->19967 19965 7ff6d09ed12c 7 API calls 19964->19965 19964->19967 19966 7ff6d09eced2 19965->19966 19967->19946 19996 7ff6d09ecfbc 19968->19996 19970 7ff6d09ed001 19970->19949 19972 7ff6d09f9034 19971->19972 19973 7ff6d09ecba5 19971->19973 19974 7ff6d09f9052 GetModuleFileNameW 19972->19974 19975 7ff6d09f903c 19972->19975 19973->19955 19995 7ff6d09ed0cc InitializeSListHead 19973->19995 19979 7ff6d09f907d 19974->19979 19976 7ff6d09f4f08 memcpy_s 11 API calls 19975->19976 19977 7ff6d09f9041 19976->19977 19978 7ff6d09fa8e0 _invalid_parameter_noinfo 37 API calls 19977->19978 19978->19973 20011 7ff6d09f8fb4 19979->20011 19982 7ff6d09f90c5 19983 7ff6d09f4f08 memcpy_s 11 API calls 19982->19983 19984 7ff6d09f90ca 19983->19984 19985 7ff6d09fa948 __free_lconv_num 11 API calls 19984->19985 19985->19973 19986 7ff6d09f90dd 19987 7ff6d09f90ff 19986->19987 19989 7ff6d09f9144 19986->19989 19990 7ff6d09f912b 19986->19990 19988 7ff6d09fa948 __free_lconv_num 11 API calls 19987->19988 19988->19973 19993 7ff6d09fa948 __free_lconv_num 11 API calls 19989->19993 19991 7ff6d09fa948 __free_lconv_num 11 API calls 19990->19991 19992 7ff6d09f9134 19991->19992 19994 7ff6d09fa948 __free_lconv_num 11 API calls 19992->19994 19993->19987 19994->19973 19997 7ff6d09ecfd6 19996->19997 19999 7ff6d09ecfcf 19996->19999 20000 7ff6d09fa1ec 19997->20000 19999->19970 20003 7ff6d09f9e28 20000->20003 20010 7ff6d0a002d8 EnterCriticalSection 20003->20010 20012 7ff6d09f8fcc 20011->20012 20013 7ff6d09f9004 20011->20013 20012->20013 20014 7ff6d09feb98 memcpy_s 11 API calls 20012->20014 20013->19982 20013->19986 20015 7ff6d09f8ffa 20014->20015 20016 7ff6d09fa948 __free_lconv_num 11 API calls 20015->20016 20016->20013 19782 7ff6d09fafd0 19783 7ff6d09fafd5 19782->19783 19784 7ff6d09fafea 19782->19784 19788 7ff6d09faff0 19783->19788 19789 7ff6d09fb032 19788->19789 19790 7ff6d09fb03a 19788->19790 19791 7ff6d09fa948 __free_lconv_num 11 API calls 19789->19791 19792 7ff6d09fa948 __free_lconv_num 11 API calls 19790->19792 19791->19790 19793 7ff6d09fb047 19792->19793 19794 7ff6d09fa948 __free_lconv_num 11 API calls 19793->19794 19795 7ff6d09fb054 19794->19795 19796 7ff6d09fa948 __free_lconv_num 11 API calls 19795->19796 19797 7ff6d09fb061 19796->19797 19798 7ff6d09fa948 __free_lconv_num 11 API calls 19797->19798 19799 7ff6d09fb06e 19798->19799 19800 7ff6d09fa948 __free_lconv_num 11 API calls 19799->19800 19801 7ff6d09fb07b 19800->19801 19802 7ff6d09fa948 __free_lconv_num 11 API calls 19801->19802 19803 7ff6d09fb088 19802->19803 19804 7ff6d09fa948 __free_lconv_num 11 API calls 19803->19804 19805 7ff6d09fb095 19804->19805 19806 7ff6d09fa948 __free_lconv_num 11 API calls 19805->19806 19807 7ff6d09fb0a5 19806->19807 19808 7ff6d09fa948 __free_lconv_num 11 API calls 19807->19808 19809 7ff6d09fb0b5 19808->19809 19814 7ff6d09fae94 19809->19814 19828 7ff6d0a002d8 EnterCriticalSection 19814->19828 20017 7ff6d09f9d50 20020 7ff6d09f9ccc 20017->20020 20027 7ff6d0a002d8 EnterCriticalSection 20020->20027 19004 7ff6d0a008c8 19005 7ff6d0a008ec 19004->19005 19007 7ff6d0a008fc 19004->19007 19006 7ff6d09f4f08 memcpy_s 11 API calls 19005->19006 19029 7ff6d0a008f1 19006->19029 19008 7ff6d0a00bdc 19007->19008 19009 7ff6d0a0091e 19007->19009 19010 7ff6d09f4f08 memcpy_s 11 API calls 19008->19010 19011 7ff6d0a0093f 19009->19011 19135 7ff6d0a00f84 19009->19135 19012 7ff6d0a00be1 19010->19012 19015 7ff6d0a009b1 19011->19015 19017 7ff6d0a00965 19011->19017 19021 7ff6d0a009a5 19011->19021 19013 7ff6d09fa948 __free_lconv_num 11 API calls 19012->19013 19013->19029 19019 7ff6d09feb98 memcpy_s 11 API calls 19015->19019 19033 7ff6d0a00974 19015->19033 19016 7ff6d0a00a5e 19028 7ff6d0a00a7b 19016->19028 19034 7ff6d0a00acd 19016->19034 19150 7ff6d09f96c0 19017->19150 19022 7ff6d0a009c7 19019->19022 19021->19016 19021->19033 19156 7ff6d0a0712c 19021->19156 19025 7ff6d09fa948 __free_lconv_num 11 API calls 19022->19025 19024 7ff6d09fa948 __free_lconv_num 11 API calls 19024->19029 19030 7ff6d0a009d5 19025->19030 19026 7ff6d0a0096f 19031 7ff6d09f4f08 memcpy_s 11 API calls 19026->19031 19027 7ff6d0a0098d 19027->19021 19036 7ff6d0a00f84 45 API calls 19027->19036 19032 7ff6d09fa948 __free_lconv_num 11 API calls 19028->19032 19030->19021 19030->19033 19038 7ff6d09feb98 memcpy_s 11 API calls 19030->19038 19031->19033 19035 7ff6d0a00a84 19032->19035 19033->19024 19034->19033 19037 7ff6d0a033dc 40 API calls 19034->19037 19045 7ff6d0a00a89 19035->19045 19192 7ff6d0a033dc 19035->19192 19036->19021 19039 7ff6d0a00b0a 19037->19039 19041 7ff6d0a009f7 19038->19041 19042 7ff6d09fa948 __free_lconv_num 11 API calls 19039->19042 19046 7ff6d09fa948 __free_lconv_num 11 API calls 19041->19046 19047 7ff6d0a00b14 19042->19047 19043 7ff6d0a00ab5 19048 7ff6d09fa948 __free_lconv_num 11 API calls 19043->19048 19044 7ff6d0a00bd0 19049 7ff6d09fa948 __free_lconv_num 11 API calls 19044->19049 19045->19044 19050 7ff6d09feb98 memcpy_s 11 API calls 19045->19050 19046->19021 19047->19033 19047->19045 19048->19045 19049->19029 19051 7ff6d0a00b58 19050->19051 19052 7ff6d0a00b60 19051->19052 19053 7ff6d0a00b69 19051->19053 19054 7ff6d09fa948 __free_lconv_num 11 API calls 19052->19054 19055 7ff6d09fa4a4 __std_exception_copy 37 API calls 19053->19055 19056 7ff6d0a00b67 19054->19056 19057 7ff6d0a00b78 19055->19057 19061 7ff6d09fa948 __free_lconv_num 11 API calls 19056->19061 19058 7ff6d0a00b80 19057->19058 19059 7ff6d0a00c0b 19057->19059 19201 7ff6d0a07244 19058->19201 19060 7ff6d09fa900 _isindst 17 API calls 19059->19060 19063 7ff6d0a00c1f 19060->19063 19061->19029 19067 7ff6d0a00c48 19063->19067 19074 7ff6d0a00c58 19063->19074 19065 7ff6d0a00bc8 19070 7ff6d09fa948 __free_lconv_num 11 API calls 19065->19070 19066 7ff6d0a00ba7 19068 7ff6d09f4f08 memcpy_s 11 API calls 19066->19068 19069 7ff6d09f4f08 memcpy_s 11 API calls 19067->19069 19071 7ff6d0a00bac 19068->19071 19072 7ff6d0a00c4d 19069->19072 19070->19044 19073 7ff6d09fa948 __free_lconv_num 11 API calls 19071->19073 19073->19056 19075 7ff6d0a00f3b 19074->19075 19076 7ff6d0a00c7a 19074->19076 19077 7ff6d09f4f08 memcpy_s 11 API calls 19075->19077 19078 7ff6d0a00c97 19076->19078 19220 7ff6d0a0106c 19076->19220 19079 7ff6d0a00f40 19077->19079 19082 7ff6d0a00d0b 19078->19082 19084 7ff6d0a00cbf 19078->19084 19088 7ff6d0a00cff 19078->19088 19080 7ff6d09fa948 __free_lconv_num 11 API calls 19079->19080 19080->19072 19086 7ff6d0a00d33 19082->19086 19089 7ff6d09feb98 memcpy_s 11 API calls 19082->19089 19103 7ff6d0a00cce 19082->19103 19083 7ff6d0a00dbe 19097 7ff6d0a00ddb 19083->19097 19104 7ff6d0a00e2e 19083->19104 19235 7ff6d09f96fc 19084->19235 19086->19088 19091 7ff6d09feb98 memcpy_s 11 API calls 19086->19091 19086->19103 19088->19083 19088->19103 19241 7ff6d0a06fec 19088->19241 19093 7ff6d0a00d25 19089->19093 19096 7ff6d0a00d55 19091->19096 19092 7ff6d09fa948 __free_lconv_num 11 API calls 19092->19072 19098 7ff6d09fa948 __free_lconv_num 11 API calls 19093->19098 19094 7ff6d0a00cc9 19099 7ff6d09f4f08 memcpy_s 11 API calls 19094->19099 19095 7ff6d0a00ce7 19095->19088 19102 7ff6d0a0106c 45 API calls 19095->19102 19100 7ff6d09fa948 __free_lconv_num 11 API calls 19096->19100 19101 7ff6d09fa948 __free_lconv_num 11 API calls 19097->19101 19098->19086 19099->19103 19100->19088 19105 7ff6d0a00de4 19101->19105 19102->19088 19103->19092 19104->19103 19106 7ff6d0a033dc 40 API calls 19104->19106 19108 7ff6d0a033dc 40 API calls 19105->19108 19112 7ff6d0a00dea 19105->19112 19107 7ff6d0a00e6c 19106->19107 19109 7ff6d09fa948 __free_lconv_num 11 API calls 19107->19109 19113 7ff6d0a00e16 19108->19113 19110 7ff6d0a00e76 19109->19110 19110->19103 19110->19112 19111 7ff6d0a00f2f 19115 7ff6d09fa948 __free_lconv_num 11 API calls 19111->19115 19112->19111 19116 7ff6d09feb98 memcpy_s 11 API calls 19112->19116 19114 7ff6d09fa948 __free_lconv_num 11 API calls 19113->19114 19114->19112 19115->19072 19117 7ff6d0a00ebb 19116->19117 19118 7ff6d0a00ec3 19117->19118 19119 7ff6d0a00ecc 19117->19119 19120 7ff6d09fa948 __free_lconv_num 11 API calls 19118->19120 19121 7ff6d0a00474 37 API calls 19119->19121 19122 7ff6d0a00eca 19120->19122 19123 7ff6d0a00eda 19121->19123 19129 7ff6d09fa948 __free_lconv_num 11 API calls 19122->19129 19124 7ff6d0a00ee2 SetEnvironmentVariableW 19123->19124 19125 7ff6d0a00f6f 19123->19125 19126 7ff6d0a00f27 19124->19126 19127 7ff6d0a00f06 19124->19127 19128 7ff6d09fa900 _isindst 17 API calls 19125->19128 19132 7ff6d09fa948 __free_lconv_num 11 API calls 19126->19132 19130 7ff6d09f4f08 memcpy_s 11 API calls 19127->19130 19131 7ff6d0a00f83 19128->19131 19129->19072 19133 7ff6d0a00f0b 19130->19133 19132->19111 19134 7ff6d09fa948 __free_lconv_num 11 API calls 19133->19134 19134->19122 19136 7ff6d0a00fb9 19135->19136 19137 7ff6d0a00fa1 19135->19137 19138 7ff6d09feb98 memcpy_s 11 API calls 19136->19138 19137->19011 19145 7ff6d0a00fdd 19138->19145 19139 7ff6d0a01062 19141 7ff6d09fa504 _CallSETranslator 45 API calls 19139->19141 19140 7ff6d0a0103e 19142 7ff6d09fa948 __free_lconv_num 11 API calls 19140->19142 19143 7ff6d0a01068 19141->19143 19142->19137 19144 7ff6d09feb98 memcpy_s 11 API calls 19144->19145 19145->19139 19145->19140 19145->19144 19146 7ff6d09fa948 __free_lconv_num 11 API calls 19145->19146 19147 7ff6d09fa4a4 __std_exception_copy 37 API calls 19145->19147 19148 7ff6d0a0104d 19145->19148 19146->19145 19147->19145 19149 7ff6d09fa900 _isindst 17 API calls 19148->19149 19149->19139 19151 7ff6d09f96d0 19150->19151 19152 7ff6d09f96d9 19150->19152 19151->19152 19265 7ff6d09f9198 19151->19265 19152->19026 19152->19027 19157 7ff6d0a06254 19156->19157 19158 7ff6d0a07139 19156->19158 19159 7ff6d0a06261 19157->19159 19165 7ff6d0a06297 19157->19165 19160 7ff6d09f4f4c 45 API calls 19158->19160 19163 7ff6d09f4f08 memcpy_s 11 API calls 19159->19163 19179 7ff6d0a06208 19159->19179 19162 7ff6d0a0716d 19160->19162 19161 7ff6d0a062c1 19164 7ff6d09f4f08 memcpy_s 11 API calls 19161->19164 19166 7ff6d0a07172 19162->19166 19171 7ff6d0a07183 19162->19171 19174 7ff6d0a0719a 19162->19174 19167 7ff6d0a0626b 19163->19167 19169 7ff6d0a062c6 19164->19169 19165->19161 19170 7ff6d0a062e6 19165->19170 19166->19021 19168 7ff6d09fa8e0 _invalid_parameter_noinfo 37 API calls 19167->19168 19172 7ff6d0a06276 19168->19172 19173 7ff6d09fa8e0 _invalid_parameter_noinfo 37 API calls 19169->19173 19180 7ff6d09f4f4c 45 API calls 19170->19180 19185 7ff6d0a062d1 19170->19185 19175 7ff6d09f4f08 memcpy_s 11 API calls 19171->19175 19172->19021 19173->19185 19177 7ff6d0a071a4 19174->19177 19178 7ff6d0a071b6 19174->19178 19176 7ff6d0a07188 19175->19176 19181 7ff6d09fa8e0 _invalid_parameter_noinfo 37 API calls 19176->19181 19182 7ff6d09f4f08 memcpy_s 11 API calls 19177->19182 19183 7ff6d0a071de 19178->19183 19184 7ff6d0a071c7 19178->19184 19179->19021 19180->19185 19181->19166 19186 7ff6d0a071a9 19182->19186 19507 7ff6d0a08f4c 19183->19507 19498 7ff6d0a062a4 19184->19498 19185->19021 19189 7ff6d09fa8e0 _invalid_parameter_noinfo 37 API calls 19186->19189 19189->19166 19191 7ff6d09f4f08 memcpy_s 11 API calls 19191->19166 19193 7ff6d0a033fe 19192->19193 19194 7ff6d0a0341b 19192->19194 19193->19194 19195 7ff6d0a0340c 19193->19195 19196 7ff6d0a03425 19194->19196 19547 7ff6d0a07c38 19194->19547 19197 7ff6d09f4f08 memcpy_s 11 API calls 19195->19197 19554 7ff6d0a07c74 19196->19554 19200 7ff6d0a03411 memcpy_s 19197->19200 19200->19043 19202 7ff6d09f4f4c 45 API calls 19201->19202 19203 7ff6d0a072aa 19202->19203 19205 7ff6d0a072b8 19203->19205 19566 7ff6d09fef24 19203->19566 19569 7ff6d09f54ac 19205->19569 19208 7ff6d0a073a4 19211 7ff6d0a073b5 19208->19211 19212 7ff6d09fa948 __free_lconv_num 11 API calls 19208->19212 19209 7ff6d09f4f4c 45 API calls 19210 7ff6d0a07327 19209->19210 19214 7ff6d09fef24 5 API calls 19210->19214 19219 7ff6d0a07330 19210->19219 19213 7ff6d0a00ba3 19211->19213 19215 7ff6d09fa948 __free_lconv_num 11 API calls 19211->19215 19212->19211 19213->19065 19213->19066 19214->19219 19215->19213 19216 7ff6d09f54ac 14 API calls 19217 7ff6d0a0738b 19216->19217 19217->19208 19218 7ff6d0a07393 SetEnvironmentVariableW 19217->19218 19218->19208 19219->19216 19221 7ff6d0a0108f 19220->19221 19222 7ff6d0a010ac 19220->19222 19221->19078 19223 7ff6d09feb98 memcpy_s 11 API calls 19222->19223 19230 7ff6d0a010d0 19223->19230 19224 7ff6d09fa504 _CallSETranslator 45 API calls 19226 7ff6d0a0115a 19224->19226 19225 7ff6d0a01131 19227 7ff6d09fa948 __free_lconv_num 11 API calls 19225->19227 19227->19221 19228 7ff6d09feb98 memcpy_s 11 API calls 19228->19230 19229 7ff6d09fa948 __free_lconv_num 11 API calls 19229->19230 19230->19225 19230->19228 19230->19229 19231 7ff6d0a00474 37 API calls 19230->19231 19232 7ff6d0a01140 19230->19232 19234 7ff6d0a01154 19230->19234 19231->19230 19233 7ff6d09fa900 _isindst 17 API calls 19232->19233 19233->19234 19234->19224 19236 7ff6d09f970c 19235->19236 19239 7ff6d09f9715 19235->19239 19236->19239 19591 7ff6d09f920c 19236->19591 19239->19094 19239->19095 19242 7ff6d0a06ff9 19241->19242 19246 7ff6d0a07026 19241->19246 19243 7ff6d0a06ffe 19242->19243 19242->19246 19244 7ff6d09f4f08 memcpy_s 11 API calls 19243->19244 19245 7ff6d0a07003 19244->19245 19248 7ff6d09fa8e0 _invalid_parameter_noinfo 37 API calls 19245->19248 19247 7ff6d0a0706a 19246->19247 19249 7ff6d0a07089 19246->19249 19263 7ff6d0a0705e __crtLCMapStringW 19246->19263 19250 7ff6d09f4f08 memcpy_s 11 API calls 19247->19250 19251 7ff6d0a0700e 19248->19251 19252 7ff6d0a070a5 19249->19252 19253 7ff6d0a07093 19249->19253 19254 7ff6d0a0706f 19250->19254 19251->19088 19257 7ff6d09f4f4c 45 API calls 19252->19257 19256 7ff6d09f4f08 memcpy_s 11 API calls 19253->19256 19255 7ff6d09fa8e0 _invalid_parameter_noinfo 37 API calls 19254->19255 19255->19263 19258 7ff6d0a07098 19256->19258 19259 7ff6d0a070b2 19257->19259 19260 7ff6d09fa8e0 _invalid_parameter_noinfo 37 API calls 19258->19260 19259->19263 19638 7ff6d0a08b08 19259->19638 19260->19263 19263->19088 19264 7ff6d09f4f08 memcpy_s 11 API calls 19264->19263 19266 7ff6d09f91b1 19265->19266 19279 7ff6d09f91ad 19265->19279 19288 7ff6d0a025f0 19266->19288 19271 7ff6d09f91c3 19273 7ff6d09fa948 __free_lconv_num 11 API calls 19271->19273 19272 7ff6d09f91cf 19314 7ff6d09f927c 19272->19314 19273->19279 19276 7ff6d09fa948 __free_lconv_num 11 API calls 19277 7ff6d09f91f6 19276->19277 19278 7ff6d09fa948 __free_lconv_num 11 API calls 19277->19278 19278->19279 19279->19152 19280 7ff6d09f94ec 19279->19280 19281 7ff6d09f9515 19280->19281 19283 7ff6d09f952e 19280->19283 19281->19152 19282 7ff6d0a007e8 WideCharToMultiByte 19282->19283 19283->19281 19283->19282 19284 7ff6d09feb98 memcpy_s 11 API calls 19283->19284 19285 7ff6d09f95be 19283->19285 19287 7ff6d09fa948 __free_lconv_num 11 API calls 19283->19287 19284->19283 19286 7ff6d09fa948 __free_lconv_num 11 API calls 19285->19286 19286->19281 19287->19283 19289 7ff6d0a025fd 19288->19289 19290 7ff6d09f91b6 19288->19290 19333 7ff6d09fb224 19289->19333 19294 7ff6d0a0292c GetEnvironmentStringsW 19290->19294 19295 7ff6d09f91bb 19294->19295 19296 7ff6d0a0295c 19294->19296 19295->19271 19295->19272 19297 7ff6d0a007e8 WideCharToMultiByte 19296->19297 19298 7ff6d0a029ad 19297->19298 19299 7ff6d0a029b4 FreeEnvironmentStringsW 19298->19299 19300 7ff6d09fd5fc _fread_nolock 12 API calls 19298->19300 19299->19295 19301 7ff6d0a029c7 19300->19301 19302 7ff6d0a029cf 19301->19302 19303 7ff6d0a029d8 19301->19303 19304 7ff6d09fa948 __free_lconv_num 11 API calls 19302->19304 19305 7ff6d0a007e8 WideCharToMultiByte 19303->19305 19306 7ff6d0a029d6 19304->19306 19307 7ff6d0a029fb 19305->19307 19306->19299 19308 7ff6d0a029ff 19307->19308 19309 7ff6d0a02a09 19307->19309 19311 7ff6d09fa948 __free_lconv_num 11 API calls 19308->19311 19310 7ff6d09fa948 __free_lconv_num 11 API calls 19309->19310 19312 7ff6d0a02a07 FreeEnvironmentStringsW 19310->19312 19311->19312 19312->19295 19315 7ff6d09f92a1 19314->19315 19316 7ff6d09feb98 memcpy_s 11 API calls 19315->19316 19327 7ff6d09f92d7 19316->19327 19317 7ff6d09f92df 19318 7ff6d09fa948 __free_lconv_num 11 API calls 19317->19318 19319 7ff6d09f91d7 19318->19319 19319->19276 19320 7ff6d09f9352 19321 7ff6d09fa948 __free_lconv_num 11 API calls 19320->19321 19321->19319 19322 7ff6d09feb98 memcpy_s 11 API calls 19322->19327 19323 7ff6d09f9341 19492 7ff6d09f94a8 19323->19492 19324 7ff6d09fa4a4 __std_exception_copy 37 API calls 19324->19327 19327->19317 19327->19320 19327->19322 19327->19323 19327->19324 19328 7ff6d09f9377 19327->19328 19330 7ff6d09fa948 __free_lconv_num 11 API calls 19327->19330 19331 7ff6d09fa900 _isindst 17 API calls 19328->19331 19329 7ff6d09fa948 __free_lconv_num 11 API calls 19329->19317 19330->19327 19332 7ff6d09f938a 19331->19332 19334 7ff6d09fb235 FlsGetValue 19333->19334 19335 7ff6d09fb250 FlsSetValue 19333->19335 19336 7ff6d09fb242 19334->19336 19337 7ff6d09fb24a 19334->19337 19335->19336 19338 7ff6d09fb25d 19335->19338 19339 7ff6d09fb248 19336->19339 19340 7ff6d09fa504 _CallSETranslator 45 API calls 19336->19340 19337->19335 19341 7ff6d09feb98 memcpy_s 11 API calls 19338->19341 19353 7ff6d0a022c4 19339->19353 19342 7ff6d09fb2c5 19340->19342 19343 7ff6d09fb26c 19341->19343 19344 7ff6d09fb28a FlsSetValue 19343->19344 19345 7ff6d09fb27a FlsSetValue 19343->19345 19346 7ff6d09fb2a8 19344->19346 19347 7ff6d09fb296 FlsSetValue 19344->19347 19348 7ff6d09fb283 19345->19348 19349 7ff6d09faef4 memcpy_s 11 API calls 19346->19349 19347->19348 19350 7ff6d09fa948 __free_lconv_num 11 API calls 19348->19350 19351 7ff6d09fb2b0 19349->19351 19350->19336 19352 7ff6d09fa948 __free_lconv_num 11 API calls 19351->19352 19352->19339 19376 7ff6d0a02534 19353->19376 19355 7ff6d0a022f9 19391 7ff6d0a01fc4 19355->19391 19358 7ff6d09fd5fc _fread_nolock 12 API calls 19359 7ff6d0a02327 19358->19359 19360 7ff6d0a0232f 19359->19360 19362 7ff6d0a0233e 19359->19362 19361 7ff6d09fa948 __free_lconv_num 11 API calls 19360->19361 19374 7ff6d0a02316 19361->19374 19362->19362 19398 7ff6d0a0266c 19362->19398 19365 7ff6d0a0243a 19366 7ff6d09f4f08 memcpy_s 11 API calls 19365->19366 19368 7ff6d0a0243f 19366->19368 19367 7ff6d0a02454 19369 7ff6d0a02495 19367->19369 19375 7ff6d09fa948 __free_lconv_num 11 API calls 19367->19375 19370 7ff6d09fa948 __free_lconv_num 11 API calls 19368->19370 19371 7ff6d0a024fc 19369->19371 19409 7ff6d0a01df4 19369->19409 19370->19374 19373 7ff6d09fa948 __free_lconv_num 11 API calls 19371->19373 19373->19374 19374->19290 19375->19369 19377 7ff6d0a02557 19376->19377 19379 7ff6d0a02561 19377->19379 19424 7ff6d0a002d8 EnterCriticalSection 19377->19424 19381 7ff6d0a025d3 19379->19381 19383 7ff6d09fa504 _CallSETranslator 45 API calls 19379->19383 19381->19355 19385 7ff6d0a025eb 19383->19385 19386 7ff6d0a02642 19385->19386 19388 7ff6d09fb224 50 API calls 19385->19388 19386->19355 19389 7ff6d0a0262c 19388->19389 19390 7ff6d0a022c4 65 API calls 19389->19390 19390->19386 19392 7ff6d09f4f4c 45 API calls 19391->19392 19393 7ff6d0a01fd8 19392->19393 19394 7ff6d0a01fe4 GetOEMCP 19393->19394 19395 7ff6d0a01ff6 19393->19395 19396 7ff6d0a0200b 19394->19396 19395->19396 19397 7ff6d0a01ffb GetACP 19395->19397 19396->19358 19396->19374 19397->19396 19399 7ff6d0a01fc4 47 API calls 19398->19399 19400 7ff6d0a02699 19399->19400 19401 7ff6d0a027ef 19400->19401 19402 7ff6d0a026d6 IsValidCodePage 19400->19402 19408 7ff6d0a026f0 memcpy_s 19400->19408 19403 7ff6d09ec550 _log10_special 8 API calls 19401->19403 19402->19401 19404 7ff6d0a026e7 19402->19404 19405 7ff6d0a02431 19403->19405 19406 7ff6d0a02716 GetCPInfo 19404->19406 19404->19408 19405->19365 19405->19367 19406->19401 19406->19408 19425 7ff6d0a020dc 19408->19425 19491 7ff6d0a002d8 EnterCriticalSection 19409->19491 19426 7ff6d0a02119 GetCPInfo 19425->19426 19427 7ff6d0a0220f 19425->19427 19426->19427 19429 7ff6d0a0212c 19426->19429 19428 7ff6d09ec550 _log10_special 8 API calls 19427->19428 19431 7ff6d0a022ae 19428->19431 19430 7ff6d0a02e40 48 API calls 19429->19430 19432 7ff6d0a021a3 19430->19432 19431->19401 19436 7ff6d0a07b84 19432->19436 19435 7ff6d0a07b84 54 API calls 19435->19427 19437 7ff6d09f4f4c 45 API calls 19436->19437 19438 7ff6d0a07ba9 19437->19438 19441 7ff6d0a07850 19438->19441 19442 7ff6d0a07891 19441->19442 19443 7ff6d09ff8a0 _fread_nolock MultiByteToWideChar 19442->19443 19446 7ff6d0a078db 19443->19446 19444 7ff6d0a07b59 19445 7ff6d09ec550 _log10_special 8 API calls 19444->19445 19447 7ff6d0a021d6 19445->19447 19446->19444 19448 7ff6d09fd5fc _fread_nolock 12 API calls 19446->19448 19450 7ff6d0a07913 19446->19450 19460 7ff6d0a07a11 19446->19460 19447->19435 19448->19450 19449 7ff6d09fa948 __free_lconv_num 11 API calls 19449->19444 19451 7ff6d09ff8a0 _fread_nolock MultiByteToWideChar 19450->19451 19450->19460 19452 7ff6d0a07986 19451->19452 19452->19460 19472 7ff6d09ff0e4 19452->19472 19455 7ff6d0a07a22 19457 7ff6d09fd5fc _fread_nolock 12 API calls 19455->19457 19459 7ff6d0a07af4 19455->19459 19462 7ff6d0a07a40 19455->19462 19456 7ff6d0a079d1 19458 7ff6d09ff0e4 __crtLCMapStringW 6 API calls 19456->19458 19456->19460 19457->19462 19458->19460 19459->19460 19461 7ff6d09fa948 __free_lconv_num 11 API calls 19459->19461 19460->19444 19460->19449 19461->19460 19462->19460 19463 7ff6d09ff0e4 __crtLCMapStringW 6 API calls 19462->19463 19464 7ff6d0a07ac0 19463->19464 19464->19459 19465 7ff6d0a07ae0 19464->19465 19466 7ff6d0a07af6 19464->19466 19468 7ff6d0a007e8 WideCharToMultiByte 19465->19468 19467 7ff6d0a007e8 WideCharToMultiByte 19466->19467 19469 7ff6d0a07aee 19467->19469 19468->19469 19469->19459 19470 7ff6d0a07b0e 19469->19470 19470->19460 19471 7ff6d09fa948 __free_lconv_num 11 API calls 19470->19471 19471->19460 19478 7ff6d09fed10 19472->19478 19476 7ff6d09ff12a 19476->19455 19476->19456 19476->19460 19477 7ff6d09ff193 LCMapStringW 19477->19476 19479 7ff6d09fed68 __vcrt_InitializeCriticalSectionEx 19478->19479 19480 7ff6d09fed6d 19478->19480 19479->19480 19481 7ff6d09fed9d LoadLibraryExW 19479->19481 19482 7ff6d09fee92 GetProcAddress 19479->19482 19487 7ff6d09fedfc LoadLibraryExW 19479->19487 19480->19476 19488 7ff6d09ff1d0 19480->19488 19483 7ff6d09fee72 19481->19483 19484 7ff6d09fedc2 GetLastError 19481->19484 19482->19480 19486 7ff6d09feea3 19482->19486 19483->19482 19485 7ff6d09fee89 FreeLibrary 19483->19485 19484->19479 19485->19482 19486->19480 19487->19479 19487->19483 19489 7ff6d09fed10 __crtLCMapStringW 5 API calls 19488->19489 19490 7ff6d09ff1fe __crtLCMapStringW 19489->19490 19490->19477 19493 7ff6d09f94ad 19492->19493 19494 7ff6d09f9349 19492->19494 19495 7ff6d09f94d6 19493->19495 19497 7ff6d09fa948 __free_lconv_num 11 API calls 19493->19497 19494->19329 19496 7ff6d09fa948 __free_lconv_num 11 API calls 19495->19496 19496->19494 19497->19493 19499 7ff6d0a062c1 19498->19499 19500 7ff6d0a062d8 19498->19500 19501 7ff6d09f4f08 memcpy_s 11 API calls 19499->19501 19500->19499 19503 7ff6d0a062e6 19500->19503 19502 7ff6d0a062c6 19501->19502 19504 7ff6d09fa8e0 _invalid_parameter_noinfo 37 API calls 19502->19504 19505 7ff6d09f4f4c 45 API calls 19503->19505 19506 7ff6d0a062d1 19503->19506 19504->19506 19505->19506 19506->19166 19508 7ff6d09f4f4c 45 API calls 19507->19508 19509 7ff6d0a08f71 19508->19509 19512 7ff6d0a08bc8 19509->19512 19516 7ff6d0a08c16 19512->19516 19513 7ff6d09ec550 _log10_special 8 API calls 19514 7ff6d0a07205 19513->19514 19514->19166 19514->19191 19515 7ff6d0a08c9d 19517 7ff6d09ff8a0 _fread_nolock MultiByteToWideChar 19515->19517 19521 7ff6d0a08ca1 19515->19521 19516->19515 19518 7ff6d0a08c88 GetCPInfo 19516->19518 19516->19521 19519 7ff6d0a08d35 19517->19519 19518->19515 19518->19521 19520 7ff6d09fd5fc _fread_nolock 12 API calls 19519->19520 19519->19521 19522 7ff6d0a08d6c 19519->19522 19520->19522 19521->19513 19522->19521 19523 7ff6d09ff8a0 _fread_nolock MultiByteToWideChar 19522->19523 19524 7ff6d0a08dda 19523->19524 19525 7ff6d0a08ebc 19524->19525 19526 7ff6d09ff8a0 _fread_nolock MultiByteToWideChar 19524->19526 19525->19521 19527 7ff6d09fa948 __free_lconv_num 11 API calls 19525->19527 19528 7ff6d0a08e00 19526->19528 19527->19521 19528->19525 19529 7ff6d09fd5fc _fread_nolock 12 API calls 19528->19529 19530 7ff6d0a08e2d 19528->19530 19529->19530 19530->19525 19531 7ff6d09ff8a0 _fread_nolock MultiByteToWideChar 19530->19531 19532 7ff6d0a08ea4 19531->19532 19533 7ff6d0a08eaa 19532->19533 19534 7ff6d0a08ec4 19532->19534 19533->19525 19537 7ff6d09fa948 __free_lconv_num 11 API calls 19533->19537 19541 7ff6d09fef68 19534->19541 19537->19525 19538 7ff6d0a08f03 19538->19521 19540 7ff6d09fa948 __free_lconv_num 11 API calls 19538->19540 19539 7ff6d09fa948 __free_lconv_num 11 API calls 19539->19538 19540->19521 19542 7ff6d09fed10 __crtLCMapStringW 5 API calls 19541->19542 19543 7ff6d09fefa6 19542->19543 19544 7ff6d09fefae 19543->19544 19545 7ff6d09ff1d0 __crtLCMapStringW 5 API calls 19543->19545 19544->19538 19544->19539 19546 7ff6d09ff017 CompareStringW 19545->19546 19546->19544 19548 7ff6d0a07c41 19547->19548 19549 7ff6d0a07c5a HeapSize 19547->19549 19550 7ff6d09f4f08 memcpy_s 11 API calls 19548->19550 19551 7ff6d0a07c46 19550->19551 19552 7ff6d09fa8e0 _invalid_parameter_noinfo 37 API calls 19551->19552 19553 7ff6d0a07c51 19552->19553 19553->19196 19555 7ff6d0a07c93 19554->19555 19556 7ff6d0a07c89 19554->19556 19558 7ff6d0a07c98 19555->19558 19564 7ff6d0a07c9f memcpy_s 19555->19564 19557 7ff6d09fd5fc _fread_nolock 12 API calls 19556->19557 19562 7ff6d0a07c91 19557->19562 19561 7ff6d09fa948 __free_lconv_num 11 API calls 19558->19561 19559 7ff6d0a07ca5 19563 7ff6d09f4f08 memcpy_s 11 API calls 19559->19563 19560 7ff6d0a07cd2 HeapReAlloc 19560->19562 19560->19564 19561->19562 19562->19200 19563->19562 19564->19559 19564->19560 19565 7ff6d0a03590 memcpy_s 2 API calls 19564->19565 19565->19564 19567 7ff6d09fed10 __crtLCMapStringW 5 API calls 19566->19567 19568 7ff6d09fef44 19567->19568 19568->19205 19570 7ff6d09f54fa 19569->19570 19571 7ff6d09f54d6 19569->19571 19572 7ff6d09f5554 19570->19572 19573 7ff6d09f54ff 19570->19573 19575 7ff6d09fa948 __free_lconv_num 11 API calls 19571->19575 19579 7ff6d09f54e5 19571->19579 19574 7ff6d09ff8a0 _fread_nolock MultiByteToWideChar 19572->19574 19576 7ff6d09f5514 19573->19576 19573->19579 19580 7ff6d09fa948 __free_lconv_num 11 API calls 19573->19580 19585 7ff6d09f5570 19574->19585 19575->19579 19577 7ff6d09fd5fc _fread_nolock 12 API calls 19576->19577 19577->19579 19578 7ff6d09f5577 GetLastError 19581 7ff6d09f4e7c _fread_nolock 11 API calls 19578->19581 19579->19208 19579->19209 19580->19576 19584 7ff6d09f5584 19581->19584 19582 7ff6d09f55b2 19582->19579 19583 7ff6d09ff8a0 _fread_nolock MultiByteToWideChar 19582->19583 19588 7ff6d09f55f6 19583->19588 19589 7ff6d09f4f08 memcpy_s 11 API calls 19584->19589 19585->19578 19585->19582 19586 7ff6d09f55a5 19585->19586 19590 7ff6d09fa948 __free_lconv_num 11 API calls 19585->19590 19587 7ff6d09fd5fc _fread_nolock 12 API calls 19586->19587 19587->19582 19588->19578 19588->19579 19589->19579 19590->19586 19592 7ff6d09f9225 19591->19592 19593 7ff6d09f9221 19591->19593 19612 7ff6d0a02a3c GetEnvironmentStringsW 19592->19612 19593->19239 19604 7ff6d09f95cc 19593->19604 19596 7ff6d09f9232 19598 7ff6d09fa948 __free_lconv_num 11 API calls 19596->19598 19597 7ff6d09f923e 19619 7ff6d09f938c 19597->19619 19598->19593 19601 7ff6d09fa948 __free_lconv_num 11 API calls 19602 7ff6d09f9265 19601->19602 19603 7ff6d09fa948 __free_lconv_num 11 API calls 19602->19603 19603->19593 19605 7ff6d09f95ef 19604->19605 19610 7ff6d09f9606 19604->19610 19605->19239 19606 7ff6d09feb98 memcpy_s 11 API calls 19606->19610 19607 7ff6d09f967a 19609 7ff6d09fa948 __free_lconv_num 11 API calls 19607->19609 19608 7ff6d09ff8a0 MultiByteToWideChar _fread_nolock 19608->19610 19609->19605 19610->19605 19610->19606 19610->19607 19610->19608 19611 7ff6d09fa948 __free_lconv_num 11 API calls 19610->19611 19611->19610 19613 7ff6d09f922a 19612->19613 19614 7ff6d0a02a60 19612->19614 19613->19596 19613->19597 19615 7ff6d09fd5fc _fread_nolock 12 API calls 19614->19615 19616 7ff6d0a02a97 memcpy_s 19615->19616 19617 7ff6d09fa948 __free_lconv_num 11 API calls 19616->19617 19618 7ff6d0a02ab7 FreeEnvironmentStringsW 19617->19618 19618->19613 19620 7ff6d09f93b4 19619->19620 19621 7ff6d09feb98 memcpy_s 11 API calls 19620->19621 19633 7ff6d09f93ef 19621->19633 19622 7ff6d09f93f7 19623 7ff6d09fa948 __free_lconv_num 11 API calls 19622->19623 19625 7ff6d09f9246 19623->19625 19624 7ff6d09f9471 19626 7ff6d09fa948 __free_lconv_num 11 API calls 19624->19626 19625->19601 19626->19625 19627 7ff6d09feb98 memcpy_s 11 API calls 19627->19633 19628 7ff6d09f9460 19630 7ff6d09f94a8 11 API calls 19628->19630 19629 7ff6d0a00474 37 API calls 19629->19633 19631 7ff6d09f9468 19630->19631 19634 7ff6d09fa948 __free_lconv_num 11 API calls 19631->19634 19632 7ff6d09f9494 19635 7ff6d09fa900 _isindst 17 API calls 19632->19635 19633->19622 19633->19624 19633->19627 19633->19628 19633->19629 19633->19632 19636 7ff6d09fa948 __free_lconv_num 11 API calls 19633->19636 19634->19622 19637 7ff6d09f94a6 19635->19637 19636->19633 19639 7ff6d0a08b31 __crtLCMapStringW 19638->19639 19640 7ff6d0a070ee 19639->19640 19641 7ff6d09fef68 6 API calls 19639->19641 19640->19263 19640->19264 19641->19640 20262 7ff6d09fc520 20273 7ff6d0a002d8 EnterCriticalSection 20262->20273 20414 7ff6d0a016b0 20425 7ff6d0a073e4 20414->20425 20426 7ff6d0a073f1 20425->20426 20427 7ff6d09fa948 __free_lconv_num 11 API calls 20426->20427 20428 7ff6d0a0740d 20426->20428 20427->20426 20429 7ff6d09fa948 __free_lconv_num 11 API calls 20428->20429 20430 7ff6d0a016b9 20428->20430 20429->20428 20431 7ff6d0a002d8 EnterCriticalSection 20430->20431 18891 7ff6d09f5628 18892 7ff6d09f5642 18891->18892 18893 7ff6d09f565f 18891->18893 18895 7ff6d09f4ee8 _fread_nolock 11 API calls 18892->18895 18893->18892 18894 7ff6d09f5672 CreateFileW 18893->18894 18896 7ff6d09f56dc 18894->18896 18897 7ff6d09f56a6 18894->18897 18898 7ff6d09f5647 18895->18898 18942 7ff6d09f5c04 18896->18942 18916 7ff6d09f577c GetFileType 18897->18916 18901 7ff6d09f4f08 memcpy_s 11 API calls 18898->18901 18902 7ff6d09f564f 18901->18902 18905 7ff6d09fa8e0 _invalid_parameter_noinfo 37 API calls 18902->18905 18910 7ff6d09f565a 18905->18910 18906 7ff6d09f56d1 CloseHandle 18906->18910 18907 7ff6d09f56bb CloseHandle 18907->18910 18908 7ff6d09f56e5 18912 7ff6d09f4e7c _fread_nolock 11 API calls 18908->18912 18909 7ff6d09f5710 18963 7ff6d09f59c4 18909->18963 18915 7ff6d09f56ef 18912->18915 18915->18910 18917 7ff6d09f57ca 18916->18917 18918 7ff6d09f5887 18916->18918 18921 7ff6d09f57f6 GetFileInformationByHandle 18917->18921 18926 7ff6d09f5b00 21 API calls 18917->18926 18919 7ff6d09f58b1 18918->18919 18920 7ff6d09f588f 18918->18920 18925 7ff6d09f58d4 PeekNamedPipe 18919->18925 18931 7ff6d09f5872 18919->18931 18922 7ff6d09f58a2 GetLastError 18920->18922 18923 7ff6d09f5893 18920->18923 18921->18922 18924 7ff6d09f581f 18921->18924 18929 7ff6d09f4e7c _fread_nolock 11 API calls 18922->18929 18927 7ff6d09f4f08 memcpy_s 11 API calls 18923->18927 18928 7ff6d09f59c4 51 API calls 18924->18928 18925->18931 18930 7ff6d09f57e4 18926->18930 18927->18931 18932 7ff6d09f582a 18928->18932 18929->18931 18930->18921 18930->18931 18933 7ff6d09ec550 _log10_special 8 API calls 18931->18933 18980 7ff6d09f5924 18932->18980 18935 7ff6d09f56b4 18933->18935 18935->18906 18935->18907 18937 7ff6d09f5924 10 API calls 18938 7ff6d09f5849 18937->18938 18939 7ff6d09f5924 10 API calls 18938->18939 18940 7ff6d09f585a 18939->18940 18940->18931 18941 7ff6d09f4f08 memcpy_s 11 API calls 18940->18941 18941->18931 18943 7ff6d09f5c3a 18942->18943 18944 7ff6d09f4f08 memcpy_s 11 API calls 18943->18944 18962 7ff6d09f5cd2 __std_exception_destroy 18943->18962 18946 7ff6d09f5c4c 18944->18946 18945 7ff6d09ec550 _log10_special 8 API calls 18947 7ff6d09f56e1 18945->18947 18948 7ff6d09f4f08 memcpy_s 11 API calls 18946->18948 18947->18908 18947->18909 18949 7ff6d09f5c54 18948->18949 18950 7ff6d09f7e08 45 API calls 18949->18950 18951 7ff6d09f5c69 18950->18951 18952 7ff6d09f5c71 18951->18952 18953 7ff6d09f5c7b 18951->18953 18954 7ff6d09f4f08 memcpy_s 11 API calls 18952->18954 18955 7ff6d09f4f08 memcpy_s 11 API calls 18953->18955 18959 7ff6d09f5c76 18954->18959 18956 7ff6d09f5c80 18955->18956 18957 7ff6d09f4f08 memcpy_s 11 API calls 18956->18957 18956->18962 18958 7ff6d09f5c8a 18957->18958 18960 7ff6d09f7e08 45 API calls 18958->18960 18961 7ff6d09f5cc4 GetDriveTypeW 18959->18961 18959->18962 18960->18959 18961->18962 18962->18945 18965 7ff6d09f59ec 18963->18965 18964 7ff6d09f571d 18973 7ff6d09f5b00 18964->18973 18965->18964 18987 7ff6d09ff724 18965->18987 18967 7ff6d09f5a80 18967->18964 18968 7ff6d09ff724 51 API calls 18967->18968 18969 7ff6d09f5a93 18968->18969 18969->18964 18970 7ff6d09ff724 51 API calls 18969->18970 18971 7ff6d09f5aa6 18970->18971 18971->18964 18972 7ff6d09ff724 51 API calls 18971->18972 18972->18964 18974 7ff6d09f5b1a 18973->18974 18975 7ff6d09f5b51 18974->18975 18976 7ff6d09f5b2a 18974->18976 18977 7ff6d09ff5b8 21 API calls 18975->18977 18978 7ff6d09f5b3a 18976->18978 18979 7ff6d09f4e7c _fread_nolock 11 API calls 18976->18979 18977->18978 18978->18915 18979->18978 18981 7ff6d09f5940 18980->18981 18982 7ff6d09f594d FileTimeToSystemTime 18980->18982 18981->18982 18984 7ff6d09f5948 18981->18984 18983 7ff6d09f5961 SystemTimeToTzSpecificLocalTime 18982->18983 18982->18984 18983->18984 18985 7ff6d09ec550 _log10_special 8 API calls 18984->18985 18986 7ff6d09f5839 18985->18986 18986->18937 18988 7ff6d09ff731 18987->18988 18992 7ff6d09ff755 18987->18992 18989 7ff6d09ff736 18988->18989 18988->18992 18991 7ff6d09f4f08 memcpy_s 11 API calls 18989->18991 18990 7ff6d09ff78f 18993 7ff6d09f4f08 memcpy_s 11 API calls 18990->18993 18995 7ff6d09ff73b 18991->18995 18992->18990 18994 7ff6d09ff7ae 18992->18994 18996 7ff6d09ff794 18993->18996 18997 7ff6d09f4f4c 45 API calls 18994->18997 18998 7ff6d09fa8e0 _invalid_parameter_noinfo 37 API calls 18995->18998 18999 7ff6d09fa8e0 _invalid_parameter_noinfo 37 API calls 18996->18999 19002 7ff6d09ff7bb 18997->19002 19000 7ff6d09ff746 18998->19000 19001 7ff6d09ff79f 18999->19001 19000->18967 19001->18967 19002->19001 19003 7ff6d0a004dc 51 API calls 19002->19003 19003->19002 19864 7ff6d09f5410 19865 7ff6d09f541b 19864->19865 19873 7ff6d09ff2a4 19865->19873 19886 7ff6d0a002d8 EnterCriticalSection 19873->19886 19887 7ff6d0a0adfe 19888 7ff6d0a0ae17 19887->19888 19889 7ff6d0a0ae0d 19887->19889 19891 7ff6d0a00338 LeaveCriticalSection 19889->19891 18837 7ff6d09ff98c 18838 7ff6d09ffb7e 18837->18838 18840 7ff6d09ff9ce _isindst 18837->18840 18839 7ff6d09f4f08 memcpy_s 11 API calls 18838->18839 18857 7ff6d09ffb6e 18839->18857 18840->18838 18843 7ff6d09ffa4e _isindst 18840->18843 18841 7ff6d09ec550 _log10_special 8 API calls 18842 7ff6d09ffb99 18841->18842 18858 7ff6d0a06194 18843->18858 18848 7ff6d09ffbaa 18849 7ff6d09fa900 _isindst 17 API calls 18848->18849 18851 7ff6d09ffbbe 18849->18851 18855 7ff6d09ffaab 18855->18857 18882 7ff6d0a061d8 18855->18882 18857->18841 18859 7ff6d0a061a3 18858->18859 18863 7ff6d09ffa6c 18858->18863 18889 7ff6d0a002d8 EnterCriticalSection 18859->18889 18864 7ff6d0a05598 18863->18864 18865 7ff6d0a055a1 18864->18865 18866 7ff6d09ffa81 18864->18866 18867 7ff6d09f4f08 memcpy_s 11 API calls 18865->18867 18866->18848 18870 7ff6d0a055c8 18866->18870 18868 7ff6d0a055a6 18867->18868 18869 7ff6d09fa8e0 _invalid_parameter_noinfo 37 API calls 18868->18869 18869->18866 18871 7ff6d0a055d1 18870->18871 18872 7ff6d09ffa92 18870->18872 18873 7ff6d09f4f08 memcpy_s 11 API calls 18871->18873 18872->18848 18876 7ff6d0a055f8 18872->18876 18874 7ff6d0a055d6 18873->18874 18875 7ff6d09fa8e0 _invalid_parameter_noinfo 37 API calls 18874->18875 18875->18872 18877 7ff6d0a05601 18876->18877 18878 7ff6d09ffaa3 18876->18878 18879 7ff6d09f4f08 memcpy_s 11 API calls 18877->18879 18878->18848 18878->18855 18880 7ff6d0a05606 18879->18880 18881 7ff6d09fa8e0 _invalid_parameter_noinfo 37 API calls 18880->18881 18881->18878 18890 7ff6d0a002d8 EnterCriticalSection 18882->18890

                                                                                                                                                                                                                                                        Executed Functions

                                                                                                                                                                                                                                                        Function 00007FF6D09E89E0 Relevance: 70.3, APIs: 36, Strings: 4, Instructions: 257synchronizationwindowregistryCOMMON
                                                                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                                                                        control_flow_graph 0 7ff6d09e89e0-7ff6d09e8b26 call 7ff6d09ec850 call 7ff6d09e9390 SetConsoleCtrlHandler GetStartupInfoW call 7ff6d09f53f0 call 7ff6d09fa47c call 7ff6d09f871c call 7ff6d09f53f0 call 7ff6d09fa47c call 7ff6d09f871c call 7ff6d09f53f0 call 7ff6d09fa47c call 7ff6d09f871c GetCommandLineW CreateProcessW 23 7ff6d09e8b4d-7ff6d09e8b89 RegisterClassW 0->23 24 7ff6d09e8b28-7ff6d09e8b48 GetLastError call 7ff6d09e2c50 0->24 26 7ff6d09e8b91-7ff6d09e8be5 CreateWindowExW 23->26 27 7ff6d09e8b8b GetLastError 23->27 31 7ff6d09e8e39-7ff6d09e8e5f call 7ff6d09ec550 24->31 29 7ff6d09e8bef-7ff6d09e8bf4 ShowWindow 26->29 30 7ff6d09e8be7-7ff6d09e8bed GetLastError 26->30 27->26 32 7ff6d09e8bfa-7ff6d09e8c0a WaitForSingleObject 29->32 30->32 34 7ff6d09e8c0c 32->34 35 7ff6d09e8c88-7ff6d09e8c8f 32->35 39 7ff6d09e8c10-7ff6d09e8c13 34->39 36 7ff6d09e8cd2-7ff6d09e8cd9 35->36 37 7ff6d09e8c91-7ff6d09e8ca1 WaitForSingleObject 35->37 42 7ff6d09e8dc0-7ff6d09e8dd9 GetMessageW 36->42 43 7ff6d09e8cdf-7ff6d09e8cf5 QueryPerformanceFrequency QueryPerformanceCounter 36->43 40 7ff6d09e8df8-7ff6d09e8e02 37->40 41 7ff6d09e8ca7-7ff6d09e8cb7 TerminateProcess 37->41 44 7ff6d09e8c15 GetLastError 39->44 45 7ff6d09e8c1b-7ff6d09e8c22 39->45 46 7ff6d09e8e04-7ff6d09e8e0a DestroyWindow 40->46 47 7ff6d09e8e11-7ff6d09e8e35 GetExitCodeProcess CloseHandle * 2 40->47 48 7ff6d09e8cbf-7ff6d09e8ccd WaitForSingleObject 41->48 49 7ff6d09e8cb9 GetLastError 41->49 52 7ff6d09e8def-7ff6d09e8df6 42->52 53 7ff6d09e8ddb-7ff6d09e8de9 TranslateMessage DispatchMessageW 42->53 50 7ff6d09e8d00-7ff6d09e8d38 MsgWaitForMultipleObjects PeekMessageW 43->50 44->45 45->37 51 7ff6d09e8c24-7ff6d09e8c41 PeekMessageW 45->51 46->47 47->31 48->40 49->48 54 7ff6d09e8d73-7ff6d09e8d7a 50->54 55 7ff6d09e8d3a 50->55 56 7ff6d09e8c43-7ff6d09e8c74 TranslateMessage DispatchMessageW PeekMessageW 51->56 57 7ff6d09e8c76-7ff6d09e8c86 WaitForSingleObject 51->57 52->40 52->42 53->52 54->42 59 7ff6d09e8d7c-7ff6d09e8da5 QueryPerformanceCounter 54->59 58 7ff6d09e8d40-7ff6d09e8d71 TranslateMessage DispatchMessageW PeekMessageW 55->58 56->56 56->57 57->35 57->39 58->54 58->58 59->50 60 7ff6d09e8dab-7ff6d09e8db2 59->60 60->40 61 7ff6d09e8db4-7ff6d09e8db8 60->61 61->42
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2100369578.00007FF6D09E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D09E0000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100323166.00007FF6D09E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100453442.00007FF6D0A0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A22000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100684836.00007FF6D0A24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff6d09e0000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: Message$ErrorLast$ObjectProcessSingleWait$CloseCreateHandlePeekWindow_invalid_parameter_noinfo$ByteCharClassCodeCommandConsoleCtrlCurrentDestroyDispatchExitFormatHandlerInfoLineMultiRegisterStartupTerminateTranslateWide
                                                                                                                                                                                                                                                        • String ID: CreateProcessW$Failed to create child process!$PyInstaller Onefile Hidden Window$PyInstallerOnefileHiddenWindow
                                                                                                                                                                                                                                                        • API String ID: 3832162212-3165540532
                                                                                                                                                                                                                                                        • Opcode ID: 99838be411f58a84d89697932930ae4644c798f1dd42cd928399edbb9bf0e48e
                                                                                                                                                                                                                                                        • Instruction ID: 1c041c2bf00e6a7509045843fe90a2af158539d2eb8f2e2fdb29c652ec2e9437
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 99838be411f58a84d89697932930ae4644c798f1dd42cd928399edbb9bf0e48e
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: C5D1D132A19A86A6E7148F75E8502AE3760FF84758F141237DA5DC6BAECF3CD564C700
                                                                                                                                                                                                                                                        Function 00007FF6D09E1000 Relevance: 61.8, APIs: 7, Strings: 28, Instructions: 511COMMON
                                                                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                                                                        control_flow_graph 62 7ff6d09e1000-7ff6d09e3806 call 7ff6d09efe18 call 7ff6d09efe20 call 7ff6d09ec850 call 7ff6d09f53f0 call 7ff6d09f5484 call 7ff6d09e36b0 76 7ff6d09e3814-7ff6d09e3836 call 7ff6d09e1950 62->76 77 7ff6d09e3808-7ff6d09e380f 62->77 82 7ff6d09e391b-7ff6d09e3931 call 7ff6d09e45c0 76->82 83 7ff6d09e383c-7ff6d09e3856 call 7ff6d09e1c80 76->83 78 7ff6d09e3c97-7ff6d09e3cb2 call 7ff6d09ec550 77->78 90 7ff6d09e3933-7ff6d09e3960 call 7ff6d09e7f90 82->90 91 7ff6d09e396a-7ff6d09e397f call 7ff6d09e2710 82->91 87 7ff6d09e385b-7ff6d09e389b call 7ff6d09e8830 83->87 97 7ff6d09e38c1-7ff6d09e38cc call 7ff6d09f4f30 87->97 98 7ff6d09e389d-7ff6d09e38a3 87->98 99 7ff6d09e3962-7ff6d09e3965 call 7ff6d09f004c 90->99 100 7ff6d09e3984-7ff6d09e39a6 call 7ff6d09e1c80 90->100 101 7ff6d09e3c8f 91->101 109 7ff6d09e38d2-7ff6d09e38e1 call 7ff6d09e8830 97->109 110 7ff6d09e39fc-7ff6d09e3a2a call 7ff6d09e8940 call 7ff6d09e89a0 * 3 97->110 102 7ff6d09e38a5-7ff6d09e38ad 98->102 103 7ff6d09e38af-7ff6d09e38bd call 7ff6d09e89a0 98->103 99->91 115 7ff6d09e39b0-7ff6d09e39b9 100->115 101->78 102->103 103->97 119 7ff6d09e39f4-7ff6d09e39f7 call 7ff6d09f4f30 109->119 120 7ff6d09e38e7-7ff6d09e38ed 109->120 138 7ff6d09e3a2f-7ff6d09e3a3e call 7ff6d09e8830 110->138 115->115 118 7ff6d09e39bb-7ff6d09e39d8 call 7ff6d09e1950 115->118 118->87 130 7ff6d09e39de-7ff6d09e39ef call 7ff6d09e2710 118->130 119->110 124 7ff6d09e38f0-7ff6d09e38fc 120->124 127 7ff6d09e3905-7ff6d09e3908 124->127 128 7ff6d09e38fe-7ff6d09e3903 124->128 127->119 131 7ff6d09e390e-7ff6d09e3916 call 7ff6d09f4f30 127->131 128->124 128->127 130->101 131->138 141 7ff6d09e3b45-7ff6d09e3b53 138->141 142 7ff6d09e3a44-7ff6d09e3a47 138->142 143 7ff6d09e3a67 141->143 144 7ff6d09e3b59-7ff6d09e3b5d 141->144 142->141 145 7ff6d09e3a4d-7ff6d09e3a50 142->145 146 7ff6d09e3a6b-7ff6d09e3a90 call 7ff6d09f4f30 143->146 144->146 147 7ff6d09e3b14-7ff6d09e3b17 145->147 148 7ff6d09e3a56-7ff6d09e3a5a 145->148 157 7ff6d09e3a92-7ff6d09e3aa6 call 7ff6d09e8940 146->157 158 7ff6d09e3aab-7ff6d09e3ac0 146->158 150 7ff6d09e3b2f-7ff6d09e3b40 call 7ff6d09e2710 147->150 151 7ff6d09e3b19-7ff6d09e3b1d 147->151 148->147 149 7ff6d09e3a60 148->149 149->143 159 7ff6d09e3c7f-7ff6d09e3c87 150->159 151->150 153 7ff6d09e3b1f-7ff6d09e3b2a 151->153 153->146 157->158 161 7ff6d09e3ac6-7ff6d09e3aca 158->161 162 7ff6d09e3be8-7ff6d09e3bfa call 7ff6d09e8830 158->162 159->101 164 7ff6d09e3ad0-7ff6d09e3ae8 call 7ff6d09f5250 161->164 165 7ff6d09e3bcd-7ff6d09e3be2 call 7ff6d09e1940 161->165 170 7ff6d09e3c2e 162->170 171 7ff6d09e3bfc-7ff6d09e3c02 162->171 175 7ff6d09e3b62-7ff6d09e3b7a call 7ff6d09f5250 164->175 176 7ff6d09e3aea-7ff6d09e3b02 call 7ff6d09f5250 164->176 165->161 165->162 177 7ff6d09e3c31-7ff6d09e3c40 call 7ff6d09f4f30 170->177 173 7ff6d09e3c04-7ff6d09e3c1c 171->173 174 7ff6d09e3c1e-7ff6d09e3c2c 171->174 173->177 174->177 186 7ff6d09e3b7c-7ff6d09e3b80 175->186 187 7ff6d09e3b87-7ff6d09e3b9f call 7ff6d09f5250 175->187 176->165 188 7ff6d09e3b08-7ff6d09e3b0f 176->188 184 7ff6d09e3d41-7ff6d09e3d63 call 7ff6d09e44e0 177->184 185 7ff6d09e3c46-7ff6d09e3c4a 177->185 199 7ff6d09e3d65-7ff6d09e3d6f call 7ff6d09e4630 184->199 200 7ff6d09e3d71-7ff6d09e3d82 call 7ff6d09e1c80 184->200 189 7ff6d09e3cd4-7ff6d09e3ce6 call 7ff6d09e8830 185->189 190 7ff6d09e3c50-7ff6d09e3c5f call 7ff6d09e90e0 185->190 186->187 201 7ff6d09e3ba1-7ff6d09e3ba5 187->201 202 7ff6d09e3bac-7ff6d09e3bc4 call 7ff6d09f5250 187->202 188->165 206 7ff6d09e3d35-7ff6d09e3d3c 189->206 207 7ff6d09e3ce8-7ff6d09e3ceb 189->207 204 7ff6d09e3cb3-7ff6d09e3cb6 call 7ff6d09e8660 190->204 205 7ff6d09e3c61 190->205 214 7ff6d09e3d87-7ff6d09e3d96 199->214 200->214 201->202 202->165 217 7ff6d09e3bc6 202->217 216 7ff6d09e3cbb-7ff6d09e3cbd 204->216 211 7ff6d09e3c68 call 7ff6d09e2710 205->211 206->211 207->206 212 7ff6d09e3ced-7ff6d09e3d10 call 7ff6d09e1c80 207->212 225 7ff6d09e3c6d-7ff6d09e3c77 211->225 229 7ff6d09e3d12-7ff6d09e3d26 call 7ff6d09e2710 call 7ff6d09f4f30 212->229 230 7ff6d09e3d2b-7ff6d09e3d33 call 7ff6d09f4f30 212->230 220 7ff6d09e3dc4-7ff6d09e3dda call 7ff6d09e9390 214->220 221 7ff6d09e3d98-7ff6d09e3d9f 214->221 223 7ff6d09e3cbf-7ff6d09e3cc6 216->223 224 7ff6d09e3cc8-7ff6d09e3ccf 216->224 217->165 233 7ff6d09e3ddc 220->233 234 7ff6d09e3de8-7ff6d09e3e04 SetDllDirectoryW 220->234 221->220 227 7ff6d09e3da1-7ff6d09e3da5 221->227 223->211 224->214 225->159 227->220 231 7ff6d09e3da7-7ff6d09e3dbe SetDllDirectoryW LoadLibraryExW 227->231 229->225 230->214 231->220 233->234 237 7ff6d09e3f01-7ff6d09e3f08 234->237 238 7ff6d09e3e0a-7ff6d09e3e19 call 7ff6d09e8830 234->238 240 7ff6d09e3f0e-7ff6d09e3f15 237->240 241 7ff6d09e4008-7ff6d09e4010 237->241 251 7ff6d09e3e32-7ff6d09e3e3c call 7ff6d09f4f30 238->251 252 7ff6d09e3e1b-7ff6d09e3e21 238->252 240->241 244 7ff6d09e3f1b-7ff6d09e3f25 call 7ff6d09e33c0 240->244 245 7ff6d09e4012-7ff6d09e402f PostMessageW GetMessageW 241->245 246 7ff6d09e4035-7ff6d09e4067 call 7ff6d09e36a0 call 7ff6d09e3360 call 7ff6d09e3670 call 7ff6d09e6fc0 call 7ff6d09e6d70 241->246 244->225 258 7ff6d09e3f2b-7ff6d09e3f3f call 7ff6d09e90c0 244->258 245->246 263 7ff6d09e3ef2-7ff6d09e3efc call 7ff6d09e8940 251->263 264 7ff6d09e3e42-7ff6d09e3e48 251->264 255 7ff6d09e3e23-7ff6d09e3e2b 252->255 256 7ff6d09e3e2d-7ff6d09e3e2f 252->256 255->256 256->251 271 7ff6d09e3f64-7ff6d09e3fa0 call 7ff6d09e8940 call 7ff6d09e89e0 call 7ff6d09e6fc0 call 7ff6d09e6d70 call 7ff6d09e88e0 258->271 272 7ff6d09e3f41-7ff6d09e3f5e PostMessageW GetMessageW 258->272 263->237 264->263 268 7ff6d09e3e4e-7ff6d09e3e54 264->268 269 7ff6d09e3e5f-7ff6d09e3e61 268->269 270 7ff6d09e3e56-7ff6d09e3e58 268->270 269->237 275 7ff6d09e3e67-7ff6d09e3e83 call 7ff6d09e6dc0 call 7ff6d09e7340 269->275 274 7ff6d09e3e5a 270->274 270->275 306 7ff6d09e3fa5-7ff6d09e3fa7 271->306 272->271 274->237 289 7ff6d09e3e85-7ff6d09e3e8c 275->289 290 7ff6d09e3e8e-7ff6d09e3e95 275->290 292 7ff6d09e3edb-7ff6d09e3ef0 call 7ff6d09e2a50 call 7ff6d09e6fc0 call 7ff6d09e6d70 289->292 293 7ff6d09e3eaf-7ff6d09e3eb9 call 7ff6d09e71b0 290->293 294 7ff6d09e3e97-7ff6d09e3ea4 call 7ff6d09e6e00 290->294 292->237 304 7ff6d09e3ec4-7ff6d09e3ed2 call 7ff6d09e74f0 293->304 305 7ff6d09e3ebb-7ff6d09e3ec2 293->305 294->293 308 7ff6d09e3ea6-7ff6d09e3ead 294->308 304->237 318 7ff6d09e3ed4 304->318 305->292 310 7ff6d09e3ff5-7ff6d09e4003 call 7ff6d09e1900 306->310 311 7ff6d09e3fa9-7ff6d09e3fbf call 7ff6d09e8ed0 call 7ff6d09e88e0 306->311 308->292 310->225 311->310 323 7ff6d09e3fc1-7ff6d09e3fd6 311->323 318->292 324 7ff6d09e3ff0 call 7ff6d09e2a50 323->324 325 7ff6d09e3fd8-7ff6d09e3feb call 7ff6d09e2710 call 7ff6d09e1900 323->325 324->310 325->225
                                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2100369578.00007FF6D09E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D09E0000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100323166.00007FF6D09E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100453442.00007FF6D0A0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A22000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100684836.00007FF6D0A24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff6d09e0000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: ErrorFileLastModuleName
                                                                                                                                                                                                                                                        • String ID: Could not create temporary directory!$Could not load PyInstaller's embedded PKG archive from the executable (%s)$Could not side-load PyInstaller's PKG archive from external file (%s)$Failed to convert DLL search path!$Failed to initialize security descriptor for temporary directory!$Failed to load Tcl/Tk shared libraries for splash screen!$Failed to load splash screen resources!$Failed to remove temporary directory: %s$Failed to start splash screen!$Failed to unpack splash screen dependencies from PKG archive!$Invalid value in _PYI_PARENT_PROCESS_LEVEL: %s$MEI$PYINSTALLER_RESET_ENVIRONMENT$PYINSTALLER_STRICT_UNPACK_MODE$PYINSTALLER_SUPPRESS_SPLASH_SCREEN$Path exceeds PYI_PATH_MAX limit.$Py_GIL_DISABLED$VCRUNTIME140.dll$_PYI_APPLICATION_HOME_DIR$_PYI_APPLICATION_HOME_DIR not set for onefile child process!$_PYI_ARCHIVE_FILE$_PYI_PARENT_PROCESS_LEVEL$_PYI_SPLASH_IPC$pkg$pyi-contents-directory$pyi-disable-windowed-traceback$pyi-python-flag$pyi-runtime-tmpdir
                                                                                                                                                                                                                                                        • API String ID: 2776309574-4232158417
                                                                                                                                                                                                                                                        • Opcode ID: 2d77af2a2f9236e5f1bda1603447cca491bc739d444c9c91c5f96d0c69afedc5
                                                                                                                                                                                                                                                        • Instruction ID: a6592dbe3827e356133bab30d7f88d9f2a4431c85bc425dbf9a034c6d1eec82a
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 2d77af2a2f9236e5f1bda1603447cca491bc739d444c9c91c5f96d0c69afedc5
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 1C326D22A0E686B1EA19D721D5582BD2651BF44788F84A037DA5DCB3DFDF2CE974C300
                                                                                                                                                                                                                                                        Function 00007FF6D0A05C00 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 334timeCOMMON
                                                                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                                                                        control_flow_graph 479 7ff6d0a05c00-7ff6d0a05c3b call 7ff6d0a05588 call 7ff6d0a05590 call 7ff6d0a055f8 486 7ff6d0a05e65-7ff6d0a05eb1 call 7ff6d09fa900 call 7ff6d0a05588 call 7ff6d0a05590 call 7ff6d0a055f8 479->486 487 7ff6d0a05c41-7ff6d0a05c4c call 7ff6d0a05598 479->487 512 7ff6d0a05fef-7ff6d0a0605d call 7ff6d09fa900 call 7ff6d0a01578 486->512 513 7ff6d0a05eb7-7ff6d0a05ec2 call 7ff6d0a05598 486->513 487->486 493 7ff6d0a05c52-7ff6d0a05c5c 487->493 495 7ff6d0a05c7e-7ff6d0a05c82 493->495 496 7ff6d0a05c5e-7ff6d0a05c61 493->496 497 7ff6d0a05c85-7ff6d0a05c8d 495->497 499 7ff6d0a05c64-7ff6d0a05c6f 496->499 497->497 500 7ff6d0a05c8f-7ff6d0a05ca2 call 7ff6d09fd5fc 497->500 502 7ff6d0a05c71-7ff6d0a05c78 499->502 503 7ff6d0a05c7a-7ff6d0a05c7c 499->503 510 7ff6d0a05ca4-7ff6d0a05ca6 call 7ff6d09fa948 500->510 511 7ff6d0a05cba-7ff6d0a05cc6 call 7ff6d09fa948 500->511 502->499 502->503 503->495 504 7ff6d0a05cab-7ff6d0a05cb9 503->504 510->504 520 7ff6d0a05ccd-7ff6d0a05cd5 511->520 533 7ff6d0a0605f-7ff6d0a06066 512->533 534 7ff6d0a0606b-7ff6d0a0606e 512->534 513->512 522 7ff6d0a05ec8-7ff6d0a05ed3 call 7ff6d0a055c8 513->522 520->520 523 7ff6d0a05cd7-7ff6d0a05ce8 call 7ff6d0a00474 520->523 522->512 531 7ff6d0a05ed9-7ff6d0a05efc call 7ff6d09fa948 GetTimeZoneInformation 522->531 523->486 532 7ff6d0a05cee-7ff6d0a05d44 call 7ff6d0a0a4d0 * 4 call 7ff6d0a05b1c 523->532 547 7ff6d0a05fc4-7ff6d0a05fee call 7ff6d0a05580 call 7ff6d0a05570 call 7ff6d0a05578 531->547 548 7ff6d0a05f02-7ff6d0a05f23 531->548 591 7ff6d0a05d46-7ff6d0a05d4a 532->591 537 7ff6d0a060fb-7ff6d0a060fe 533->537 538 7ff6d0a060a5-7ff6d0a060b8 call 7ff6d09fd5fc 534->538 539 7ff6d0a06070 534->539 540 7ff6d0a06104-7ff6d0a0610c call 7ff6d0a05c00 537->540 541 7ff6d0a06073 537->541 553 7ff6d0a060c3-7ff6d0a060de call 7ff6d0a01578 538->553 554 7ff6d0a060ba 538->554 539->541 550 7ff6d0a06078-7ff6d0a060a4 call 7ff6d09fa948 call 7ff6d09ec550 540->550 541->550 551 7ff6d0a06073 call 7ff6d0a05e7c 541->551 555 7ff6d0a05f25-7ff6d0a05f2b 548->555 556 7ff6d0a05f2e-7ff6d0a05f35 548->556 551->550 579 7ff6d0a060e5-7ff6d0a060f7 call 7ff6d09fa948 553->579 580 7ff6d0a060e0-7ff6d0a060e3 553->580 561 7ff6d0a060bc-7ff6d0a060c1 call 7ff6d09fa948 554->561 555->556 563 7ff6d0a05f49 556->563 564 7ff6d0a05f37-7ff6d0a05f3f 556->564 561->539 567 7ff6d0a05f4b-7ff6d0a05fbf call 7ff6d0a0a4d0 * 4 call 7ff6d0a02b5c call 7ff6d0a06114 * 2 563->567 564->563 571 7ff6d0a05f41-7ff6d0a05f47 564->571 567->547 571->567 579->537 580->561 593 7ff6d0a05d50-7ff6d0a05d54 591->593 594 7ff6d0a05d4c 591->594 593->591 596 7ff6d0a05d56-7ff6d0a05d7b call 7ff6d09f6b58 593->596 594->593 602 7ff6d0a05d7e-7ff6d0a05d82 596->602 604 7ff6d0a05d84-7ff6d0a05d8f 602->604 605 7ff6d0a05d91-7ff6d0a05d95 602->605 604->605 607 7ff6d0a05d97-7ff6d0a05d9b 604->607 605->602 610 7ff6d0a05d9d-7ff6d0a05dc5 call 7ff6d09f6b58 607->610 611 7ff6d0a05e1c-7ff6d0a05e20 607->611 618 7ff6d0a05de3-7ff6d0a05de7 610->618 619 7ff6d0a05dc7 610->619 612 7ff6d0a05e22-7ff6d0a05e24 611->612 613 7ff6d0a05e27-7ff6d0a05e34 611->613 612->613 616 7ff6d0a05e4f-7ff6d0a05e5e call 7ff6d0a05580 call 7ff6d0a05570 613->616 617 7ff6d0a05e36-7ff6d0a05e4c call 7ff6d0a05b1c 613->617 616->486 617->616 618->611 625 7ff6d0a05de9-7ff6d0a05e07 call 7ff6d09f6b58 618->625 623 7ff6d0a05dca-7ff6d0a05dd1 619->623 623->618 626 7ff6d0a05dd3-7ff6d0a05de1 623->626 631 7ff6d0a05e13-7ff6d0a05e1a 625->631 626->618 626->623 631->611 632 7ff6d0a05e09-7ff6d0a05e0d 631->632 632->611 633 7ff6d0a05e0f 632->633 633->631
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        • _get_daylight.LIBCMT ref: 00007FF6D0A05C45
                                                                                                                                                                                                                                                          • Part of subcall function 00007FF6D0A05598: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6D0A055AC
                                                                                                                                                                                                                                                          • Part of subcall function 00007FF6D09FA948: RtlFreeHeap.NTDLL(?,?,?,00007FF6D0A02D22,?,?,?,00007FF6D0A02D5F,?,?,00000000,00007FF6D0A03225,?,?,?,00007FF6D0A03157), ref: 00007FF6D09FA95E
                                                                                                                                                                                                                                                          • Part of subcall function 00007FF6D09FA948: GetLastError.KERNEL32(?,?,?,00007FF6D0A02D22,?,?,?,00007FF6D0A02D5F,?,?,00000000,00007FF6D0A03225,?,?,?,00007FF6D0A03157), ref: 00007FF6D09FA968
                                                                                                                                                                                                                                                          • Part of subcall function 00007FF6D09FA900: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF6D09FA8DF,?,?,?,?,?,00007FF6D09FA7CA), ref: 00007FF6D09FA909
                                                                                                                                                                                                                                                          • Part of subcall function 00007FF6D09FA900: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF6D09FA8DF,?,?,?,?,?,00007FF6D09FA7CA), ref: 00007FF6D09FA92E
                                                                                                                                                                                                                                                        • _get_daylight.LIBCMT ref: 00007FF6D0A05C34
                                                                                                                                                                                                                                                          • Part of subcall function 00007FF6D0A055F8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6D0A0560C
                                                                                                                                                                                                                                                        • _get_daylight.LIBCMT ref: 00007FF6D0A05EAA
                                                                                                                                                                                                                                                        • _get_daylight.LIBCMT ref: 00007FF6D0A05EBB
                                                                                                                                                                                                                                                        • _get_daylight.LIBCMT ref: 00007FF6D0A05ECC
                                                                                                                                                                                                                                                        • GetTimeZoneInformation.KERNELBASE(?,?,?,?,?,?,?,?,?,00000000,?,00007FF6D0A0610C), ref: 00007FF6D0A05EF3
                                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2100369578.00007FF6D09E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D09E0000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100323166.00007FF6D09E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100453442.00007FF6D0A0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A22000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100684836.00007FF6D0A24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff6d09e0000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: _get_daylight$_invalid_parameter_noinfo$CurrentErrorFeatureFreeHeapInformationLastPresentProcessProcessorTimeZone
                                                                                                                                                                                                                                                        • String ID: Eastern Standard Time$Eastern Summer Time
                                                                                                                                                                                                                                                        • API String ID: 4070488512-239921721
                                                                                                                                                                                                                                                        • Opcode ID: c8e181fbda5929fcc8f6a75e148055e791a7ddaa32984997676ab034941af52a
                                                                                                                                                                                                                                                        • Instruction ID: 66e38184289a3be2b4f4b6e99bd80dc3e597eb48f2b04b08605f0f5e7aee020e
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: c8e181fbda5929fcc8f6a75e148055e791a7ddaa32984997676ab034941af52a
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 30D19D27A0C246A6E728DF37D8411BE6751AF94784F489037EA4D8B79FDE3CE4618740
                                                                                                                                                                                                                                                        Function 00007FF6D0A06964 Relevance: 13.8, APIs: 9, Instructions: 276fileCOMMON
                                                                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                                                                        control_flow_graph 693 7ff6d0a06964-7ff6d0a069d7 call 7ff6d0a06698 696 7ff6d0a069f1-7ff6d0a069fb call 7ff6d09f8520 693->696 697 7ff6d0a069d9-7ff6d0a069e2 call 7ff6d09f4ee8 693->697 702 7ff6d0a069fd-7ff6d0a06a14 call 7ff6d09f4ee8 call 7ff6d09f4f08 696->702 703 7ff6d0a06a16-7ff6d0a06a7f CreateFileW 696->703 704 7ff6d0a069e5-7ff6d0a069ec call 7ff6d09f4f08 697->704 702->704 706 7ff6d0a06a81-7ff6d0a06a87 703->706 707 7ff6d0a06afc-7ff6d0a06b07 GetFileType 703->707 721 7ff6d0a06d32-7ff6d0a06d52 704->721 710 7ff6d0a06ac9-7ff6d0a06af7 GetLastError call 7ff6d09f4e7c 706->710 711 7ff6d0a06a89-7ff6d0a06a8d 706->711 713 7ff6d0a06b5a-7ff6d0a06b61 707->713 714 7ff6d0a06b09-7ff6d0a06b44 GetLastError call 7ff6d09f4e7c CloseHandle 707->714 710->704 711->710 719 7ff6d0a06a8f-7ff6d0a06ac7 CreateFileW 711->719 717 7ff6d0a06b63-7ff6d0a06b67 713->717 718 7ff6d0a06b69-7ff6d0a06b6c 713->718 714->704 727 7ff6d0a06b4a-7ff6d0a06b55 call 7ff6d09f4f08 714->727 724 7ff6d0a06b72-7ff6d0a06bc7 call 7ff6d09f8438 717->724 718->724 725 7ff6d0a06b6e 718->725 719->707 719->710 732 7ff6d0a06bc9-7ff6d0a06bd5 call 7ff6d0a068a0 724->732 733 7ff6d0a06be6-7ff6d0a06c17 call 7ff6d0a06418 724->733 725->724 727->704 732->733 740 7ff6d0a06bd7 732->740 738 7ff6d0a06c1d-7ff6d0a06c5f 733->738 739 7ff6d0a06c19-7ff6d0a06c1b 733->739 742 7ff6d0a06c81-7ff6d0a06c8c 738->742 743 7ff6d0a06c61-7ff6d0a06c65 738->743 741 7ff6d0a06bd9-7ff6d0a06be1 call 7ff6d09faac0 739->741 740->741 741->721 746 7ff6d0a06c92-7ff6d0a06c96 742->746 747 7ff6d0a06d30 742->747 743->742 745 7ff6d0a06c67-7ff6d0a06c7c 743->745 745->742 746->747 749 7ff6d0a06c9c-7ff6d0a06ce1 CloseHandle CreateFileW 746->749 747->721 750 7ff6d0a06ce3-7ff6d0a06d11 GetLastError call 7ff6d09f4e7c call 7ff6d09f8660 749->750 751 7ff6d0a06d16-7ff6d0a06d2b 749->751 750->751 751->747
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2100369578.00007FF6D09E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D09E0000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100323166.00007FF6D09E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100453442.00007FF6D0A0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A22000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100684836.00007FF6D0A24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff6d09e0000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
                                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                                        • API String ID: 1617910340-0
                                                                                                                                                                                                                                                        • Opcode ID: baaa1bd2bfcf3e8d87424e6061cd652f961a4b3dae6ad7eaae94581ee29caa63
                                                                                                                                                                                                                                                        • Instruction ID: 164288afb55d3a770f19b57e4f06bf6d42ae9702afe0eadfec71595e560aba31
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: baaa1bd2bfcf3e8d87424e6061cd652f961a4b3dae6ad7eaae94581ee29caa63
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 66C1B133B28A4595EB14CF6AC4912AD3765F749B98F05523ADE2E9B79ECF38D061C300
                                                                                                                                                                                                                                                        Function 00007FF6D09E83C0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 89fileCOMMON
                                                                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        • FindFirstFileW.KERNELBASE(?,00007FF6D09E8919,00007FF6D09E3FA5), ref: 00007FF6D09E842B
                                                                                                                                                                                                                                                        • RemoveDirectoryW.KERNEL32(?,00007FF6D09E8919,00007FF6D09E3FA5), ref: 00007FF6D09E84AE
                                                                                                                                                                                                                                                        • DeleteFileW.KERNELBASE(?,00007FF6D09E8919,00007FF6D09E3FA5), ref: 00007FF6D09E84CD
                                                                                                                                                                                                                                                        • FindNextFileW.KERNELBASE(?,00007FF6D09E8919,00007FF6D09E3FA5), ref: 00007FF6D09E84DB
                                                                                                                                                                                                                                                        • FindClose.KERNEL32(?,00007FF6D09E8919,00007FF6D09E3FA5), ref: 00007FF6D09E84EC
                                                                                                                                                                                                                                                        • RemoveDirectoryW.KERNELBASE(?,00007FF6D09E8919,00007FF6D09E3FA5), ref: 00007FF6D09E84F5
                                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2100369578.00007FF6D09E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D09E0000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100323166.00007FF6D09E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100453442.00007FF6D0A0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A22000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100684836.00007FF6D0A24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff6d09e0000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: FileFind$DirectoryRemove$CloseDeleteFirstNext
                                                                                                                                                                                                                                                        • String ID: %s\*
                                                                                                                                                                                                                                                        • API String ID: 1057558799-766152087
                                                                                                                                                                                                                                                        • Opcode ID: 7c12b01ff297979e1ecdf005a6213684df6049b407edb1b83f88227167b7eee2
                                                                                                                                                                                                                                                        • Instruction ID: 1d3cc0cb36fe40e25eb1a303680d9bb97aaa10b7b81667f4aadfec04efb0c7a8
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 7c12b01ff297979e1ecdf005a6213684df6049b407edb1b83f88227167b7eee2
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 1B41A232A1D947A1EA209B61E4541BE2360FB94758F441233E5ADC67EEEF3CD9668700
                                                                                                                                                                                                                                                        Function 00007FF6D0A05E7C Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 143timeCOMMON
                                                                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                                                                        control_flow_graph 1014 7ff6d0a05e7c-7ff6d0a05eb1 call 7ff6d0a05588 call 7ff6d0a05590 call 7ff6d0a055f8 1021 7ff6d0a05fef-7ff6d0a0605d call 7ff6d09fa900 call 7ff6d0a01578 1014->1021 1022 7ff6d0a05eb7-7ff6d0a05ec2 call 7ff6d0a05598 1014->1022 1034 7ff6d0a0605f-7ff6d0a06066 1021->1034 1035 7ff6d0a0606b-7ff6d0a0606e 1021->1035 1022->1021 1027 7ff6d0a05ec8-7ff6d0a05ed3 call 7ff6d0a055c8 1022->1027 1027->1021 1033 7ff6d0a05ed9-7ff6d0a05efc call 7ff6d09fa948 GetTimeZoneInformation 1027->1033 1046 7ff6d0a05fc4-7ff6d0a05fee call 7ff6d0a05580 call 7ff6d0a05570 call 7ff6d0a05578 1033->1046 1047 7ff6d0a05f02-7ff6d0a05f23 1033->1047 1037 7ff6d0a060fb-7ff6d0a060fe 1034->1037 1038 7ff6d0a060a5-7ff6d0a060b8 call 7ff6d09fd5fc 1035->1038 1039 7ff6d0a06070 1035->1039 1040 7ff6d0a06104-7ff6d0a0610c call 7ff6d0a05c00 1037->1040 1041 7ff6d0a06073 1037->1041 1051 7ff6d0a060c3-7ff6d0a060de call 7ff6d0a01578 1038->1051 1052 7ff6d0a060ba 1038->1052 1039->1041 1048 7ff6d0a06078-7ff6d0a060a4 call 7ff6d09fa948 call 7ff6d09ec550 1040->1048 1041->1048 1049 7ff6d0a06073 call 7ff6d0a05e7c 1041->1049 1053 7ff6d0a05f25-7ff6d0a05f2b 1047->1053 1054 7ff6d0a05f2e-7ff6d0a05f35 1047->1054 1049->1048 1073 7ff6d0a060e5-7ff6d0a060f7 call 7ff6d09fa948 1051->1073 1074 7ff6d0a060e0-7ff6d0a060e3 1051->1074 1058 7ff6d0a060bc-7ff6d0a060c1 call 7ff6d09fa948 1052->1058 1053->1054 1060 7ff6d0a05f49 1054->1060 1061 7ff6d0a05f37-7ff6d0a05f3f 1054->1061 1058->1039 1063 7ff6d0a05f4b-7ff6d0a05fbf call 7ff6d0a0a4d0 * 4 call 7ff6d0a02b5c call 7ff6d0a06114 * 2 1060->1063 1061->1060 1067 7ff6d0a05f41-7ff6d0a05f47 1061->1067 1063->1046 1067->1063 1073->1037 1074->1058
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        • _get_daylight.LIBCMT ref: 00007FF6D0A05EAA
                                                                                                                                                                                                                                                          • Part of subcall function 00007FF6D0A055F8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6D0A0560C
                                                                                                                                                                                                                                                        • _get_daylight.LIBCMT ref: 00007FF6D0A05EBB
                                                                                                                                                                                                                                                          • Part of subcall function 00007FF6D0A05598: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6D0A055AC
                                                                                                                                                                                                                                                        • _get_daylight.LIBCMT ref: 00007FF6D0A05ECC
                                                                                                                                                                                                                                                          • Part of subcall function 00007FF6D0A055C8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6D0A055DC
                                                                                                                                                                                                                                                          • Part of subcall function 00007FF6D09FA948: RtlFreeHeap.NTDLL(?,?,?,00007FF6D0A02D22,?,?,?,00007FF6D0A02D5F,?,?,00000000,00007FF6D0A03225,?,?,?,00007FF6D0A03157), ref: 00007FF6D09FA95E
                                                                                                                                                                                                                                                          • Part of subcall function 00007FF6D09FA948: GetLastError.KERNEL32(?,?,?,00007FF6D0A02D22,?,?,?,00007FF6D0A02D5F,?,?,00000000,00007FF6D0A03225,?,?,?,00007FF6D0A03157), ref: 00007FF6D09FA968
                                                                                                                                                                                                                                                        • GetTimeZoneInformation.KERNELBASE(?,?,?,?,?,?,?,?,?,00000000,?,00007FF6D0A0610C), ref: 00007FF6D0A05EF3
                                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2100369578.00007FF6D09E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D09E0000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100323166.00007FF6D09E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100453442.00007FF6D0A0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A22000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100684836.00007FF6D0A24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff6d09e0000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: _get_daylight_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
                                                                                                                                                                                                                                                        • String ID: Eastern Standard Time$Eastern Summer Time
                                                                                                                                                                                                                                                        • API String ID: 3458911817-239921721
                                                                                                                                                                                                                                                        • Opcode ID: 6f2171165b001c2744b9d494c76d2a7753c36df5ed5d67f3075860c83c0dbe14
                                                                                                                                                                                                                                                        • Instruction ID: aa72d6167e706b7a433abad8c72b83b1dce9109ddd4c098689236fbd2bd2098d
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 6f2171165b001c2744b9d494c76d2a7753c36df5ed5d67f3075860c83c0dbe14
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 8B516023A0C646A6E728DF32D8811AE6760BB58784F489137EA4DC779FDF3CE4608740
                                                                                                                                                                                                                                                        Function 00007FF6D09E9280 Relevance: 3.0, APIs: 2, Instructions: 29COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2100369578.00007FF6D09E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D09E0000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100323166.00007FF6D09E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100453442.00007FF6D0A0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A22000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100684836.00007FF6D0A24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff6d09e0000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: Find$CloseFileFirst
                                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                                        • API String ID: 2295610775-0
                                                                                                                                                                                                                                                        • Opcode ID: 3849ca1beccae91a12aeced599bc73bdbec409d6dd090ca7d2ec6d5d284a4285
                                                                                                                                                                                                                                                        • Instruction ID: 0a9c964f69650bd0d8743b18a6d3717ae02265dabd5718434ec87261d38c95a2
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 3849ca1beccae91a12aeced599bc73bdbec409d6dd090ca7d2ec6d5d284a4285
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 36F0C832A1D74196FB608B60B49876E7390BB84328F041337DA7D867D9DF7CD469CA00
                                                                                                                                                                                                                                                        Function 00007FF6D0A008C8 Relevance: 2.0, APIs: 1, Instructions: 461COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2100369578.00007FF6D09E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D09E0000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100323166.00007FF6D09E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100453442.00007FF6D0A0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A22000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100684836.00007FF6D0A24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff6d09e0000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: CurrentFeaturePresentProcessProcessor
                                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                                        • API String ID: 1010374628-0
                                                                                                                                                                                                                                                        • Opcode ID: 537422541fbed36a77ddee3a41e978a3695e14332b64c7d8d0a2d6c09592a1ae
                                                                                                                                                                                                                                                        • Instruction ID: 35eafa134b3c5e6a445ee583c37a02939530d37d03be136be98582955421d5cd
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 537422541fbed36a77ddee3a41e978a3695e14332b64c7d8d0a2d6c09592a1ae
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 1E02F523B1D65B60FA699B23940067D2A84AF41BA4F5D9637ED5DCA3DFDE3CA4708300
                                                                                                                                                                                                                                                        Function 00007FF6D09E1950 Relevance: 22.9, APIs: 2, Strings: 11, Instructions: 184COMMON
                                                                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                                                                        control_flow_graph 331 7ff6d09e1950-7ff6d09e198b call 7ff6d09e45c0 334 7ff6d09e1c4e-7ff6d09e1c72 call 7ff6d09ec550 331->334 335 7ff6d09e1991-7ff6d09e19d1 call 7ff6d09e7f90 331->335 340 7ff6d09e1c3b-7ff6d09e1c3e call 7ff6d09f004c 335->340 341 7ff6d09e19d7-7ff6d09e19e7 call 7ff6d09f06d4 335->341 345 7ff6d09e1c43-7ff6d09e1c4b 340->345 346 7ff6d09e19e9-7ff6d09e1a03 call 7ff6d09f4f08 call 7ff6d09e2910 341->346 347 7ff6d09e1a08-7ff6d09e1a24 call 7ff6d09f039c 341->347 345->334 346->340 352 7ff6d09e1a45-7ff6d09e1a5a call 7ff6d09f4f28 347->352 353 7ff6d09e1a26-7ff6d09e1a40 call 7ff6d09f4f08 call 7ff6d09e2910 347->353 361 7ff6d09e1a7b-7ff6d09e1b05 call 7ff6d09e1c80 * 2 call 7ff6d09f06d4 call 7ff6d09f4f44 352->361 362 7ff6d09e1a5c-7ff6d09e1a76 call 7ff6d09f4f08 call 7ff6d09e2910 352->362 353->340 375 7ff6d09e1b0a-7ff6d09e1b14 361->375 362->340 376 7ff6d09e1b35-7ff6d09e1b4e call 7ff6d09f039c 375->376 377 7ff6d09e1b16-7ff6d09e1b30 call 7ff6d09f4f08 call 7ff6d09e2910 375->377 382 7ff6d09e1b6f-7ff6d09e1b8b call 7ff6d09f0110 376->382 383 7ff6d09e1b50-7ff6d09e1b6a call 7ff6d09f4f08 call 7ff6d09e2910 376->383 377->340 391 7ff6d09e1b9e-7ff6d09e1bac 382->391 392 7ff6d09e1b8d-7ff6d09e1b99 call 7ff6d09e2710 382->392 383->340 391->340 395 7ff6d09e1bb2-7ff6d09e1bb9 391->395 392->340 397 7ff6d09e1bc1-7ff6d09e1bc7 395->397 398 7ff6d09e1be0-7ff6d09e1bef 397->398 399 7ff6d09e1bc9-7ff6d09e1bd6 397->399 398->398 400 7ff6d09e1bf1-7ff6d09e1bfa 398->400 399->400 401 7ff6d09e1c0f 400->401 402 7ff6d09e1bfc-7ff6d09e1bff 400->402 404 7ff6d09e1c11-7ff6d09e1c24 401->404 402->401 403 7ff6d09e1c01-7ff6d09e1c04 402->403 403->401 405 7ff6d09e1c06-7ff6d09e1c09 403->405 406 7ff6d09e1c2d-7ff6d09e1c39 404->406 407 7ff6d09e1c26 404->407 405->401 408 7ff6d09e1c0b-7ff6d09e1c0d 405->408 406->340 406->397 407->406 408->404
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                          • Part of subcall function 00007FF6D09E7F90: _fread_nolock.LIBCMT ref: 00007FF6D09E803A
                                                                                                                                                                                                                                                        • _fread_nolock.LIBCMT ref: 00007FF6D09E1A1B
                                                                                                                                                                                                                                                          • Part of subcall function 00007FF6D09E2910: GetCurrentProcessId.KERNEL32(?,?,?,?,00000000,00000000,?,00000000,00007FF6D09E1B6A), ref: 00007FF6D09E295E
                                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2100369578.00007FF6D09E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D09E0000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100323166.00007FF6D09E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100453442.00007FF6D0A0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A22000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100684836.00007FF6D0A24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff6d09e0000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: _fread_nolock$CurrentProcess
                                                                                                                                                                                                                                                        • String ID: Could not allocate buffer for TOC!$Could not allocate memory for archive structure!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$MEI$calloc$fread$fseek$malloc
                                                                                                                                                                                                                                                        • API String ID: 2397952137-3497178890
                                                                                                                                                                                                                                                        • Opcode ID: ed5d37bd12c92faad5b6bf746ee66ab535d4fcd70a2e81ebf99a2f5a44e873f3
                                                                                                                                                                                                                                                        • Instruction ID: 3b6ab2d8e24f5d1667d40138e1b6b8dce6d1b3c827b625028375aa5aaed2ee66
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: ed5d37bd12c92faad5b6bf746ee66ab535d4fcd70a2e81ebf99a2f5a44e873f3
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: E881B371A1D686A6EB14DB15D0412BD2390FF88788F545433E98DCB79FDE3CE9658700
                                                                                                                                                                                                                                                        Function 00007FF6D09E1600 Relevance: 22.9, APIs: 1, Strings: 12, Instructions: 145COMMON
                                                                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                                                                        control_flow_graph 409 7ff6d09e1600-7ff6d09e1611 410 7ff6d09e1613-7ff6d09e161c call 7ff6d09e1050 409->410 411 7ff6d09e1637-7ff6d09e1651 call 7ff6d09e45c0 409->411 416 7ff6d09e162e-7ff6d09e1636 410->416 417 7ff6d09e161e-7ff6d09e1629 call 7ff6d09e2710 410->417 418 7ff6d09e1653-7ff6d09e1681 call 7ff6d09f4f08 call 7ff6d09e2910 411->418 419 7ff6d09e1682-7ff6d09e169c call 7ff6d09e45c0 411->419 417->416 425 7ff6d09e169e-7ff6d09e16b3 call 7ff6d09e2710 419->425 426 7ff6d09e16b8-7ff6d09e16cf call 7ff6d09f06d4 419->426 433 7ff6d09e1821-7ff6d09e1824 call 7ff6d09f004c 425->433 434 7ff6d09e16d1-7ff6d09e16f4 call 7ff6d09f4f08 call 7ff6d09e2910 426->434 435 7ff6d09e16f9-7ff6d09e16fd 426->435 441 7ff6d09e1829-7ff6d09e183b 433->441 447 7ff6d09e1819-7ff6d09e181c call 7ff6d09f004c 434->447 438 7ff6d09e16ff-7ff6d09e170b call 7ff6d09e1210 435->438 439 7ff6d09e1717-7ff6d09e1737 call 7ff6d09f4f44 435->439 444 7ff6d09e1710-7ff6d09e1712 438->444 448 7ff6d09e1761-7ff6d09e176c 439->448 449 7ff6d09e1739-7ff6d09e175c call 7ff6d09f4f08 call 7ff6d09e2910 439->449 444->447 447->433 453 7ff6d09e1802-7ff6d09e180a call 7ff6d09f4f30 448->453 454 7ff6d09e1772-7ff6d09e1777 448->454 461 7ff6d09e180f-7ff6d09e1814 449->461 453->461 456 7ff6d09e1780-7ff6d09e17a2 call 7ff6d09f039c 454->456 464 7ff6d09e17a4-7ff6d09e17bc call 7ff6d09f0adc 456->464 465 7ff6d09e17da-7ff6d09e17e6 call 7ff6d09f4f08 456->465 461->447 470 7ff6d09e17c5-7ff6d09e17d8 call 7ff6d09f4f08 464->470 471 7ff6d09e17be-7ff6d09e17c1 464->471 472 7ff6d09e17ed-7ff6d09e17f8 call 7ff6d09e2910 465->472 470->472 471->456 473 7ff6d09e17c3 471->473 476 7ff6d09e17fd 472->476 473->476 476->453
                                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2100369578.00007FF6D09E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D09E0000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100323166.00007FF6D09E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100453442.00007FF6D0A0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A22000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100684836.00007FF6D0A24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff6d09e0000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: CurrentProcess
                                                                                                                                                                                                                                                        • String ID: Failed to create symbolic link %s!$Failed to extract %s: failed to allocate temporary buffer!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to open target file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$Failed to extract %s: failed to write data chunk!$fopen$fread$fseek$fwrite$malloc
                                                                                                                                                                                                                                                        • API String ID: 2050909247-1550345328
                                                                                                                                                                                                                                                        • Opcode ID: 20e17bd6c553c2d1bb16f42c1bd2daa45422ba949397fd2f79efb246dcdc4b64
                                                                                                                                                                                                                                                        • Instruction ID: 70b23e18935649b2e5a7c8622632d6ee79767407004a9786f605705dd281cf66
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 20e17bd6c553c2d1bb16f42c1bd2daa45422ba949397fd2f79efb246dcdc4b64
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: BD518E22B1A647B2EA149B1295005BD6394BF84B98F846533EE0CCB79FDF3CE965C700
                                                                                                                                                                                                                                                        Function 00007FF6D09E8660 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 116COMMON
                                                                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        • GetTempPathW.KERNEL32(?,?,00000000,00007FF6D09E3CBB), ref: 00007FF6D09E8704
                                                                                                                                                                                                                                                        • GetCurrentProcessId.KERNEL32(?,00000000,00007FF6D09E3CBB), ref: 00007FF6D09E870A
                                                                                                                                                                                                                                                        • CreateDirectoryW.KERNELBASE(?,00000000,00007FF6D09E3CBB), ref: 00007FF6D09E874C
                                                                                                                                                                                                                                                          • Part of subcall function 00007FF6D09E8830: GetEnvironmentVariableW.KERNEL32(00007FF6D09E388E), ref: 00007FF6D09E8867
                                                                                                                                                                                                                                                          • Part of subcall function 00007FF6D09E8830: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF6D09E8889
                                                                                                                                                                                                                                                          • Part of subcall function 00007FF6D09F8238: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6D09F8251
                                                                                                                                                                                                                                                          • Part of subcall function 00007FF6D09E2810: MessageBoxW.USER32 ref: 00007FF6D09E28EA
                                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2100369578.00007FF6D09E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D09E0000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100323166.00007FF6D09E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100453442.00007FF6D0A0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A22000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100684836.00007FF6D0A24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff6d09e0000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: Environment$CreateCurrentDirectoryExpandMessagePathProcessStringsTempVariable_invalid_parameter_noinfo
                                                                                                                                                                                                                                                        • String ID: LOADER: failed to set the TMP environment variable.$LOADER: length of teporary directory path exceeds maximum path length!$TMP$TMP$_MEI%d
                                                                                                                                                                                                                                                        • API String ID: 3563477958-1339014028
                                                                                                                                                                                                                                                        • Opcode ID: 191653d34e5a06968e8282251bef030903df87164e49fe651f79a53b4d97858f
                                                                                                                                                                                                                                                        • Instruction ID: 4e60c4160fd104835e1a41c00ba488f64c150a0a9f9adcb34137fb77471b0327
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 191653d34e5a06968e8282251bef030903df87164e49fe651f79a53b4d97858f
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 2C41BE12A1E64260FA14AB66A9512BE1294FF847C8F846133ED1DCF7DFDE3CE9258300
                                                                                                                                                                                                                                                        Function 00007FF6D09E1210 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 158COMMON
                                                                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                                                                        control_flow_graph 756 7ff6d09e1210-7ff6d09e126d call 7ff6d09ebd80 759 7ff6d09e126f-7ff6d09e1296 call 7ff6d09e2710 756->759 760 7ff6d09e1297-7ff6d09e12af call 7ff6d09f4f44 756->760 765 7ff6d09e12d4-7ff6d09e12e4 call 7ff6d09f4f44 760->765 766 7ff6d09e12b1-7ff6d09e12cf call 7ff6d09f4f08 call 7ff6d09e2910 760->766 772 7ff6d09e12e6-7ff6d09e1304 call 7ff6d09f4f08 call 7ff6d09e2910 765->772 773 7ff6d09e1309-7ff6d09e131b 765->773 778 7ff6d09e1439-7ff6d09e144e call 7ff6d09eba60 call 7ff6d09f4f30 * 2 766->778 772->778 776 7ff6d09e1320-7ff6d09e1345 call 7ff6d09f039c 773->776 784 7ff6d09e1431 776->784 785 7ff6d09e134b-7ff6d09e1355 call 7ff6d09f0110 776->785 793 7ff6d09e1453-7ff6d09e146d 778->793 784->778 785->784 792 7ff6d09e135b-7ff6d09e1367 785->792 794 7ff6d09e1370-7ff6d09e1398 call 7ff6d09ea1c0 792->794 797 7ff6d09e139a-7ff6d09e139d 794->797 798 7ff6d09e1416-7ff6d09e142c call 7ff6d09e2710 794->798 799 7ff6d09e139f-7ff6d09e13a9 797->799 800 7ff6d09e1411 797->800 798->784 802 7ff6d09e13d4-7ff6d09e13d7 799->802 803 7ff6d09e13ab-7ff6d09e13b9 call 7ff6d09f0adc 799->803 800->798 804 7ff6d09e13ea-7ff6d09e13ef 802->804 805 7ff6d09e13d9-7ff6d09e13e7 call 7ff6d0a09e30 802->805 809 7ff6d09e13be-7ff6d09e13c1 803->809 804->794 808 7ff6d09e13f5-7ff6d09e13f8 804->808 805->804 811 7ff6d09e13fa-7ff6d09e13fd 808->811 812 7ff6d09e140c-7ff6d09e140f 808->812 813 7ff6d09e13c3-7ff6d09e13cd call 7ff6d09f0110 809->813 814 7ff6d09e13cf-7ff6d09e13d2 809->814 811->798 815 7ff6d09e13ff-7ff6d09e1407 811->815 812->784 813->804 813->814 814->798 815->776
                                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2100369578.00007FF6D09E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D09E0000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100323166.00007FF6D09E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100453442.00007FF6D0A0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A22000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100684836.00007FF6D0A24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff6d09e0000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: CurrentProcess
                                                                                                                                                                                                                                                        • String ID: 1.3.1$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$malloc
                                                                                                                                                                                                                                                        • API String ID: 2050909247-2813020118
                                                                                                                                                                                                                                                        • Opcode ID: ef842027a1d970694cc0f789b50cc720652ec9763b74026d17365e7fd9a410f4
                                                                                                                                                                                                                                                        • Instruction ID: 260760d33eb09f9417d8b0b525b0475f77f359b53f13aae4cd8130d4d30d18da
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: ef842027a1d970694cc0f789b50cc720652ec9763b74026d17365e7fd9a410f4
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 4851C632A0E642A5E6249B12A4403BE6691FF84798F446137ED4DCB7DFEE3CE961C700
                                                                                                                                                                                                                                                        Function 00007FF6D09FED10 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMONLIBRARYCODE
                                                                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        • FreeLibrary.KERNEL32(?,?,?,00007FF6D09FF0AA,?,?,-00000018,00007FF6D09FAD53,?,?,?,00007FF6D09FAC4A,?,?,?,00007FF6D09F5F3E), ref: 00007FF6D09FEE8C
                                                                                                                                                                                                                                                        • GetProcAddress.KERNEL32(?,?,?,00007FF6D09FF0AA,?,?,-00000018,00007FF6D09FAD53,?,?,?,00007FF6D09FAC4A,?,?,?,00007FF6D09F5F3E), ref: 00007FF6D09FEE98
                                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2100369578.00007FF6D09E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D09E0000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100323166.00007FF6D09E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100453442.00007FF6D0A0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A22000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100684836.00007FF6D0A24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff6d09e0000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: AddressFreeLibraryProc
                                                                                                                                                                                                                                                        • String ID: api-ms-$ext-ms-
                                                                                                                                                                                                                                                        • API String ID: 3013587201-537541572
                                                                                                                                                                                                                                                        • Opcode ID: 113d78e4ddfca44ef7199ea688f338981f8b4522c7c5ddaba00381c3941a83e2
                                                                                                                                                                                                                                                        • Instruction ID: 5b6bc8dc7691fa4612e5d6742adb46c458d0fd17a23324315445220b6f6241ee
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 113d78e4ddfca44ef7199ea688f338981f8b4522c7c5ddaba00381c3941a83e2
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 63411922B19A0261FB15CB16A80067D2799BF48BD4F485537ED1DCB78EDF3CE8658300
                                                                                                                                                                                                                                                        Function 00007FF6D09E36B0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 61COMMON
                                                                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        • GetModuleFileNameW.KERNEL32(?,00007FF6D09E3804), ref: 00007FF6D09E36E1
                                                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,00007FF6D09E3804), ref: 00007FF6D09E36EB
                                                                                                                                                                                                                                                          • Part of subcall function 00007FF6D09E2C50: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF6D09E3706,?,00007FF6D09E3804), ref: 00007FF6D09E2C9E
                                                                                                                                                                                                                                                          • Part of subcall function 00007FF6D09E2C50: FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF6D09E3706,?,00007FF6D09E3804), ref: 00007FF6D09E2D63
                                                                                                                                                                                                                                                          • Part of subcall function 00007FF6D09E2C50: MessageBoxW.USER32 ref: 00007FF6D09E2D99
                                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2100369578.00007FF6D09E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D09E0000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100323166.00007FF6D09E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100453442.00007FF6D0A0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A22000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100684836.00007FF6D0A24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff6d09e0000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: Message$CurrentErrorFileFormatLastModuleNameProcess
                                                                                                                                                                                                                                                        • String ID: Failed to convert executable path to UTF-8.$Failed to obtain executable path.$Failed to resolve full path to executable %ls.$GetModuleFileNameW$\\?\
                                                                                                                                                                                                                                                        • API String ID: 3187769757-2863816727
                                                                                                                                                                                                                                                        • Opcode ID: 7a7bb6314ef99d1ea6b5a99dff4d55fbb7227be169d5ba9e119ffda366a0a745
                                                                                                                                                                                                                                                        • Instruction ID: 3b16a2486419b671d8efc8867afbb449ba1c1740344d1d912b63513927b24d8f
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 7a7bb6314ef99d1ea6b5a99dff4d55fbb7227be169d5ba9e119ffda366a0a745
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 7C2197A1B2D64271FA24D721E8143BE2250BF48358F445133E65DCA7DFEE6CE925C300
                                                                                                                                                                                                                                                        Function 00007FF6D09FBA5C Relevance: 10.8, APIs: 7, Instructions: 290COMMONLIBRARYCODE
                                                                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                                                                        control_flow_graph 901 7ff6d09fba5c-7ff6d09fba82 902 7ff6d09fba84-7ff6d09fba98 call 7ff6d09f4ee8 call 7ff6d09f4f08 901->902 903 7ff6d09fba9d-7ff6d09fbaa1 901->903 921 7ff6d09fbe8e 902->921 905 7ff6d09fbe77-7ff6d09fbe83 call 7ff6d09f4ee8 call 7ff6d09f4f08 903->905 906 7ff6d09fbaa7-7ff6d09fbaae 903->906 923 7ff6d09fbe89 call 7ff6d09fa8e0 905->923 906->905 908 7ff6d09fbab4-7ff6d09fbae2 906->908 908->905 912 7ff6d09fbae8-7ff6d09fbaef 908->912 913 7ff6d09fbaf1-7ff6d09fbb03 call 7ff6d09f4ee8 call 7ff6d09f4f08 912->913 914 7ff6d09fbb08-7ff6d09fbb0b 912->914 913->923 919 7ff6d09fbe73-7ff6d09fbe75 914->919 920 7ff6d09fbb11-7ff6d09fbb17 914->920 924 7ff6d09fbe91-7ff6d09fbea8 919->924 920->919 925 7ff6d09fbb1d-7ff6d09fbb20 920->925 921->924 923->921 925->913 928 7ff6d09fbb22-7ff6d09fbb47 925->928 930 7ff6d09fbb7a-7ff6d09fbb81 928->930 931 7ff6d09fbb49-7ff6d09fbb4b 928->931 932 7ff6d09fbb83-7ff6d09fbbab call 7ff6d09fd5fc call 7ff6d09fa948 * 2 930->932 933 7ff6d09fbb56-7ff6d09fbb6d call 7ff6d09f4ee8 call 7ff6d09f4f08 call 7ff6d09fa8e0 930->933 934 7ff6d09fbb72-7ff6d09fbb78 931->934 935 7ff6d09fbb4d-7ff6d09fbb54 931->935 964 7ff6d09fbbad-7ff6d09fbbc3 call 7ff6d09f4f08 call 7ff6d09f4ee8 932->964 965 7ff6d09fbbc8-7ff6d09fbbf3 call 7ff6d09fc284 932->965 962 7ff6d09fbd00 933->962 936 7ff6d09fbbf8-7ff6d09fbc0f 934->936 935->933 935->934 939 7ff6d09fbc11-7ff6d09fbc19 936->939 940 7ff6d09fbc8a-7ff6d09fbc94 call 7ff6d0a0391c 936->940 939->940 943 7ff6d09fbc1b-7ff6d09fbc1d 939->943 951 7ff6d09fbd1e 940->951 952 7ff6d09fbc9a-7ff6d09fbcaf 940->952 943->940 947 7ff6d09fbc1f-7ff6d09fbc35 943->947 947->940 954 7ff6d09fbc37-7ff6d09fbc43 947->954 960 7ff6d09fbd23-7ff6d09fbd43 ReadFile 951->960 952->951 956 7ff6d09fbcb1-7ff6d09fbcc3 GetConsoleMode 952->956 954->940 958 7ff6d09fbc45-7ff6d09fbc47 954->958 956->951 961 7ff6d09fbcc5-7ff6d09fbccd 956->961 958->940 963 7ff6d09fbc49-7ff6d09fbc61 958->963 966 7ff6d09fbe3d-7ff6d09fbe46 GetLastError 960->966 967 7ff6d09fbd49-7ff6d09fbd51 960->967 961->960 969 7ff6d09fbccf-7ff6d09fbcf1 ReadConsoleW 961->969 972 7ff6d09fbd03-7ff6d09fbd0d call 7ff6d09fa948 962->972 963->940 973 7ff6d09fbc63-7ff6d09fbc6f 963->973 964->962 965->936 970 7ff6d09fbe63-7ff6d09fbe66 966->970 971 7ff6d09fbe48-7ff6d09fbe5e call 7ff6d09f4f08 call 7ff6d09f4ee8 966->971 967->966 975 7ff6d09fbd57 967->975 978 7ff6d09fbcf3 GetLastError 969->978 979 7ff6d09fbd12-7ff6d09fbd1c 969->979 983 7ff6d09fbe6c-7ff6d09fbe6e 970->983 984 7ff6d09fbcf9-7ff6d09fbcfb call 7ff6d09f4e7c 970->984 971->962 972->924 973->940 982 7ff6d09fbc71-7ff6d09fbc73 973->982 976 7ff6d09fbd5e-7ff6d09fbd73 975->976 976->972 986 7ff6d09fbd75-7ff6d09fbd80 976->986 978->984 979->976 982->940 990 7ff6d09fbc75-7ff6d09fbc85 982->990 983->972 984->962 992 7ff6d09fbd82-7ff6d09fbd9b call 7ff6d09fb674 986->992 993 7ff6d09fbda7-7ff6d09fbdaf 986->993 990->940 1001 7ff6d09fbda0-7ff6d09fbda2 992->1001 997 7ff6d09fbdb1-7ff6d09fbdc3 993->997 998 7ff6d09fbe2b-7ff6d09fbe38 call 7ff6d09fb4b4 993->998 1002 7ff6d09fbdc5 997->1002 1003 7ff6d09fbe1e-7ff6d09fbe26 997->1003 998->1001 1001->972 1005 7ff6d09fbdca-7ff6d09fbdd1 1002->1005 1003->972 1006 7ff6d09fbdd3-7ff6d09fbdd7 1005->1006 1007 7ff6d09fbe0d-7ff6d09fbe18 1005->1007 1008 7ff6d09fbdf3 1006->1008 1009 7ff6d09fbdd9-7ff6d09fbde0 1006->1009 1007->1003 1011 7ff6d09fbdf9-7ff6d09fbe09 1008->1011 1009->1008 1010 7ff6d09fbde2-7ff6d09fbde6 1009->1010 1010->1008 1012 7ff6d09fbde8-7ff6d09fbdf1 1010->1012 1011->1005 1013 7ff6d09fbe0b 1011->1013 1012->1011 1013->1003
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2100369578.00007FF6D09E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D09E0000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100323166.00007FF6D09E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100453442.00007FF6D0A0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A22000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100684836.00007FF6D0A24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff6d09e0000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                                        • API String ID: 3215553584-0
                                                                                                                                                                                                                                                        • Opcode ID: 1c0df5e74df0118619baac061aee596465bcef498cfc928fc9eaa168a483e3b3
                                                                                                                                                                                                                                                        • Instruction ID: d0f5e870961ecdb69b579d92d072ece4f6c29e809a174e55abb5730ca3738a0b
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 1c0df5e74df0118619baac061aee596465bcef498cfc928fc9eaa168a483e3b3
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 54C1E2A2A1C686A1E7608F1590402BD2F58FB81B88F596133FB4D8B7DBCE7CE4658701
                                                                                                                                                                                                                                                        Function 00007FF6D09E8570 Relevance: 10.6, APIs: 7, Instructions: 63COMMON
                                                                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2100369578.00007FF6D09E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D09E0000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100323166.00007FF6D09E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100453442.00007FF6D0A0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A22000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100684836.00007FF6D0A24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff6d09e0000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: Token$InformationProcess$CloseConvertCurrentErrorHandleLastOpenString
                                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                                        • API String ID: 995526605-0
                                                                                                                                                                                                                                                        • Opcode ID: 1c88e2159774aae00215e56fe2a2a719af09135261df6dbcfc7a62e4558c2eb4
                                                                                                                                                                                                                                                        • Instruction ID: f4787eda5ab0cceb4a4f108e0e3f4143c0370e3139378c5064b4d61cf4c8e4e1
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 1c88e2159774aae00215e56fe2a2a719af09135261df6dbcfc7a62e4558c2eb4
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 22219132A1C64652EA108B55B54023FA3A0FFC5BA4F541237EA6DC7BEEDE7CD8558700
                                                                                                                                                                                                                                                        Function 00007FF6D09E90E0 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 64COMMON
                                                                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                          • Part of subcall function 00007FF6D09E8570: GetCurrentProcess.KERNEL32 ref: 00007FF6D09E8590
                                                                                                                                                                                                                                                          • Part of subcall function 00007FF6D09E8570: OpenProcessToken.ADVAPI32 ref: 00007FF6D09E85A3
                                                                                                                                                                                                                                                          • Part of subcall function 00007FF6D09E8570: GetTokenInformation.KERNELBASE ref: 00007FF6D09E85C8
                                                                                                                                                                                                                                                          • Part of subcall function 00007FF6D09E8570: GetLastError.KERNEL32 ref: 00007FF6D09E85D2
                                                                                                                                                                                                                                                          • Part of subcall function 00007FF6D09E8570: GetTokenInformation.KERNELBASE ref: 00007FF6D09E8612
                                                                                                                                                                                                                                                          • Part of subcall function 00007FF6D09E8570: ConvertSidToStringSidW.ADVAPI32 ref: 00007FF6D09E862E
                                                                                                                                                                                                                                                          • Part of subcall function 00007FF6D09E8570: CloseHandle.KERNEL32 ref: 00007FF6D09E8646
                                                                                                                                                                                                                                                        • LocalFree.KERNEL32(?,00007FF6D09E3C55), ref: 00007FF6D09E916C
                                                                                                                                                                                                                                                        • LocalFree.KERNEL32(?,00007FF6D09E3C55), ref: 00007FF6D09E9175
                                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2100369578.00007FF6D09E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D09E0000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100323166.00007FF6D09E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100453442.00007FF6D0A0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A22000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100684836.00007FF6D0A24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff6d09e0000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: Token$FreeInformationLocalProcess$CloseConvertCurrentErrorHandleLastOpenString
                                                                                                                                                                                                                                                        • String ID: D:(A;;FA;;;%s)$D:(A;;FA;;;%s)(A;;FA;;;%s)$S-1-3-4$Security descriptor string length exceeds PYI_PATH_MAX!
                                                                                                                                                                                                                                                        • API String ID: 6828938-1529539262
                                                                                                                                                                                                                                                        • Opcode ID: 5ed7a9ba3e6ce910408607b93085540bd422a8d0f9e00f9f84049ca226c14b37
                                                                                                                                                                                                                                                        • Instruction ID: 0988c40098757a80cc164de3477efe355e169441a6717033aa0a60f7e8e84953
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 5ed7a9ba3e6ce910408607b93085540bd422a8d0f9e00f9f84049ca226c14b37
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: EB217132A0D742A1F614AB21E5152EE6260FF88784F845037EA4DCB79FDF7CE8658740
                                                                                                                                                                                                                                                        Function 00007FF6D09E7E20 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 81COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        • CreateDirectoryW.KERNELBASE(00000000,?,00007FF6D09E352C,?,00000000,00007FF6D09E3F23), ref: 00007FF6D09E7F32
                                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2100369578.00007FF6D09E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D09E0000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100323166.00007FF6D09E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100453442.00007FF6D0A0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A22000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100684836.00007FF6D0A24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff6d09e0000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: CreateDirectory
                                                                                                                                                                                                                                                        • String ID: %.*s$%s%c$\
                                                                                                                                                                                                                                                        • API String ID: 4241100979-1685191245
                                                                                                                                                                                                                                                        • Opcode ID: 302ffdc47f1f131389ecc473fe7ae023bae846d875cccfc6523225b15fd92315
                                                                                                                                                                                                                                                        • Instruction ID: 24b1e26ab26a384f4ecd0cf04a740b14d5024e006b4d84739f3f2452ff787572
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 302ffdc47f1f131389ecc473fe7ae023bae846d875cccfc6523225b15fd92315
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 9031D82161AAC565EA218721E4103AE6354FB84BE8F441632FE6DCB7CEDE3CDA118700
                                                                                                                                                                                                                                                        Function 00007FF6D09FCF60 Relevance: 6.2, APIs: 4, Instructions: 218COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        • GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6D09FCF4B), ref: 00007FF6D09FD07C
                                                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6D09FCF4B), ref: 00007FF6D09FD107
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2100369578.00007FF6D09E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D09E0000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100323166.00007FF6D09E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100453442.00007FF6D0A0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A22000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100684836.00007FF6D0A24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff6d09e0000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: ConsoleErrorLastMode
                                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                                        • API String ID: 953036326-0
                                                                                                                                                                                                                                                        • Opcode ID: a47a8d54e36ced6583969bea4ac316e5fdc1f02f5f342ddc714eca2f45cad1a1
                                                                                                                                                                                                                                                        • Instruction ID: 930f57e884679c9544b5dde74835a6ef6e88a1bc8eb7b6ba255b3871039a402f
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: a47a8d54e36ced6583969bea4ac316e5fdc1f02f5f342ddc714eca2f45cad1a1
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 8891E572F19651A5F7649F6594402BD2FA9AB40B8CF146137EE0E9BB8ECF38D462C300
                                                                                                                                                                                                                                                        Function 00007FF6D09FF98C Relevance: 6.2, APIs: 4, Instructions: 162COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2100369578.00007FF6D09E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D09E0000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100323166.00007FF6D09E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100453442.00007FF6D0A0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A22000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100684836.00007FF6D0A24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff6d09e0000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: _get_daylight$_isindst
                                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                                        • API String ID: 4170891091-0
                                                                                                                                                                                                                                                        • Opcode ID: 873197461a12b50781dd6dd2a54ab0b7f590f407db75148e336b6c99fa373a01
                                                                                                                                                                                                                                                        • Instruction ID: 576ccc30c3309e7820e50b6d768e5ed48d0bd775ca8cc0cf793c7e93b20b9a58
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 873197461a12b50781dd6dd2a54ab0b7f590f407db75148e336b6c99fa373a01
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: A751F773F0411196EB18CF65D9616BC2B69AF4435DF501236ED1D9ABDEDF3CA4128700
                                                                                                                                                                                                                                                        Function 00007FF6D09F577C Relevance: 6.1, APIs: 4, Instructions: 119pipeCOMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2100369578.00007FF6D09E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D09E0000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100323166.00007FF6D09E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100453442.00007FF6D0A0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A22000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100684836.00007FF6D0A24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff6d09e0000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: File$ErrorHandleInformationLastNamedPeekPipeType
                                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                                        • API String ID: 2780335769-0
                                                                                                                                                                                                                                                        • Opcode ID: 6aefb500db5e0848cb3e1a230f039049599ff649377a7022c72adab745f1037c
                                                                                                                                                                                                                                                        • Instruction ID: 30a54adffc7c7f0eb82b717744c2bcf03f5ef93c92b1d75e893926abf2994bba
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 6aefb500db5e0848cb3e1a230f039049599ff649377a7022c72adab745f1037c
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: A8516F22E186419AF714DF71D4503BD2BA5AB48BACF145436EF0D9B78EDF38D4A18700
                                                                                                                                                                                                                                                        Function 00007FF6D09F5628 Relevance: 6.1, APIs: 4, Instructions: 90fileCOMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2100369578.00007FF6D09E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D09E0000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100323166.00007FF6D09E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100453442.00007FF6D0A0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A22000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100684836.00007FF6D0A24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff6d09e0000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: CloseCreateFileHandle_invalid_parameter_noinfo
                                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                                        • API String ID: 1279662727-0
                                                                                                                                                                                                                                                        • Opcode ID: 8f3d5377b4ca72f71b0fe910297a4b2920b1cd85568e136600ee028e7f718979
                                                                                                                                                                                                                                                        • Instruction ID: 8207ddf213b62286ef31a54824ffda3cd2178eed9a6a339f252017f985c09197
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 8f3d5377b4ca72f71b0fe910297a4b2920b1cd85568e136600ee028e7f718979
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 2D419322D1C78193E7149B21951036D6B64FB943A8F10A336F76C87BDADF6CA4F08740
                                                                                                                                                                                                                                                        Function 00007FF6D09ECC3C Relevance: 4.6, APIs: 3, Instructions: 94COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2100369578.00007FF6D09E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D09E0000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100323166.00007FF6D09E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100453442.00007FF6D0A0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A22000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100684836.00007FF6D0A24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff6d09e0000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_release_startup_lock
                                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                                        • API String ID: 3251591375-0
                                                                                                                                                                                                                                                        • Opcode ID: b3dd18574e8b698ea28c35ed35ed65a6730a16d6ac14c38d0a8ba428da0d66bc
                                                                                                                                                                                                                                                        • Instruction ID: a7d2a048248f6d508b3a0be5e0e02a06281e700e388e7283e36ccbb0fbdee2f2
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: b3dd18574e8b698ea28c35ed35ed65a6730a16d6ac14c38d0a8ba428da0d66bc
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 0A313961E0E24661FA18AB75A9113BD1681BF4138CF446437E98ECF3DFDE6DAD668200
                                                                                                                                                                                                                                                        Function 00007FF6D09F9A30 Relevance: 4.5, APIs: 3, Instructions: 14COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2100369578.00007FF6D09E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D09E0000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100323166.00007FF6D09E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100453442.00007FF6D0A0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A22000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100684836.00007FF6D0A24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff6d09e0000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: Process$CurrentExitTerminate
                                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                                        • API String ID: 1703294689-0
                                                                                                                                                                                                                                                        • Opcode ID: 148d460979eed4a43ebbf671c65dc2dc638c0d89c9c01e8e00358d5495882c84
                                                                                                                                                                                                                                                        • Instruction ID: e1ae70ad34663d1561b70430dd2396f237f42718ba5e08eb2f43c049d46746ae
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 148d460979eed4a43ebbf671c65dc2dc638c0d89c9c01e8e00358d5495882c84
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 6BD09E21F1C70A62EB1C6B715D5907C16596F88705F58243BD80B8A39FDD6CE86D4300
                                                                                                                                                                                                                                                        Function 00007FF6D09F013C Relevance: 3.2, APIs: 2, Instructions: 177COMMONLIBRARYCODE
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2100369578.00007FF6D09E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D09E0000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100323166.00007FF6D09E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100453442.00007FF6D0A0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A22000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100684836.00007FF6D0A24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff6d09e0000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                                        • API String ID: 3215553584-0
                                                                                                                                                                                                                                                        • Opcode ID: e80cfa20b6c7ebf2f27a6dba6ddb06cb01cda21135ba71ef9e2cf3b7629ca058
                                                                                                                                                                                                                                                        • Instruction ID: 3ba98800e2438041b7089719095d91e17a7ccc7fd5bc68e8dde435f04594deaf
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: e80cfa20b6c7ebf2f27a6dba6ddb06cb01cda21135ba71ef9e2cf3b7629ca058
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 8E51FB61B0D241A6EB249A2594006BE699DAFC4BACF185736FD7D8B7CFCE7CD4218600
                                                                                                                                                                                                                                                        Function 00007FF6D09FC134 Relevance: 3.0, APIs: 2, Instructions: 46COMMONLIBRARYCODE
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2100369578.00007FF6D09E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D09E0000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100323166.00007FF6D09E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100453442.00007FF6D0A0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A22000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100684836.00007FF6D0A24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff6d09e0000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: ErrorFileLastPointer
                                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                                        • API String ID: 2976181284-0
                                                                                                                                                                                                                                                        • Opcode ID: 7d52f85de62641260209e8dbb28c5e1251e01e8bf24b4306ce9dcd9badf2c9c6
                                                                                                                                                                                                                                                        • Instruction ID: d238907b49e4411a3c4a032298d3ac7898e4209dda65b92951ff635e8a1ea88f
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 7d52f85de62641260209e8dbb28c5e1251e01e8bf24b4306ce9dcd9badf2c9c6
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 6C11046271CA8191DB208B25A90016D6765BB41FF8F645332FE7D8BBDECE3CD0218700
                                                                                                                                                                                                                                                        Function 00007FF6D09F5924 Relevance: 3.0, APIs: 2, Instructions: 40timeCOMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        • FileTimeToSystemTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6D09F5839), ref: 00007FF6D09F5957
                                                                                                                                                                                                                                                        • SystemTimeToTzSpecificLocalTime.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6D09F5839), ref: 00007FF6D09F596D
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2100369578.00007FF6D09E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D09E0000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100323166.00007FF6D09E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100453442.00007FF6D0A0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A22000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100684836.00007FF6D0A24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff6d09e0000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: Time$System$FileLocalSpecific
                                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                                        • API String ID: 1707611234-0
                                                                                                                                                                                                                                                        • Opcode ID: 497c6f3b45805196ef8f930e068bad9451f3f50de380bc241881b145e929bf5b
                                                                                                                                                                                                                                                        • Instruction ID: a5b93ad69268bfce2b881984fa370ace040262f6737f1d786f25e13e6d9dfb40
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 497c6f3b45805196ef8f930e068bad9451f3f50de380bc241881b145e929bf5b
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: A011823260C602D1EA588B15A41103EBB64FB84775FA02237F7ADC9ADDEF6CD465DB00
                                                                                                                                                                                                                                                        Function 00007FF6D09FA948 Relevance: 3.0, APIs: 2, Instructions: 19memoryCOMMONLIBRARYCODE
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        • RtlFreeHeap.NTDLL(?,?,?,00007FF6D0A02D22,?,?,?,00007FF6D0A02D5F,?,?,00000000,00007FF6D0A03225,?,?,?,00007FF6D0A03157), ref: 00007FF6D09FA95E
                                                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,?,?,00007FF6D0A02D22,?,?,?,00007FF6D0A02D5F,?,?,00000000,00007FF6D0A03225,?,?,?,00007FF6D0A03157), ref: 00007FF6D09FA968
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2100369578.00007FF6D09E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D09E0000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100323166.00007FF6D09E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100453442.00007FF6D0A0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A22000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100684836.00007FF6D0A24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff6d09e0000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: ErrorFreeHeapLast
                                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                                        • API String ID: 485612231-0
                                                                                                                                                                                                                                                        • Opcode ID: 46e6024f15a2f57ad5ff64688e0fe3cec5898f8577aba2f63b046adc8766ef53
                                                                                                                                                                                                                                                        • Instruction ID: dd7bf146064888b7608054038573339a08dc338c7418316f5e111c5f3e2432f6
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 46e6024f15a2f57ad5ff64688e0fe3cec5898f8577aba2f63b046adc8766ef53
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 11E08651F1D20662FF185BF2544517D1A546FC4704F485037E81DCA39BDD2C68B58710
                                                                                                                                                                                                                                                        Function 00007FF6D09FAB58 Relevance: 2.6, APIs: 2, Instructions: 59COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        • CloseHandle.KERNELBASE(?,?,?,00007FF6D09FA9D5,?,?,00000000,00007FF6D09FAA8A), ref: 00007FF6D09FABC6
                                                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,?,?,00007FF6D09FA9D5,?,?,00000000,00007FF6D09FAA8A), ref: 00007FF6D09FABD0
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2100369578.00007FF6D09E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D09E0000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100323166.00007FF6D09E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100453442.00007FF6D0A0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A22000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100684836.00007FF6D0A24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff6d09e0000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: CloseErrorHandleLast
                                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                                        • API String ID: 918212764-0
                                                                                                                                                                                                                                                        • Opcode ID: ae1e15d82824e1a5fac1c7302ca2ff5641fe0b0e43db7728cd9339717749910c
                                                                                                                                                                                                                                                        • Instruction ID: 10f73f27735533cba41b578d87d61c40df1ef3133d5472388822586f5c16af7b
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: ae1e15d82824e1a5fac1c7302ca2ff5641fe0b0e43db7728cd9339717749910c
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 2521C951F1C64261FAA4576194543BD1A8A9FC4798F186237F92ECF7DFCE6CA4614300
                                                                                                                                                                                                                                                        Function 00007FF6D09FBEAC Relevance: 1.6, APIs: 1, Instructions: 112COMMONLIBRARYCODE
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2100369578.00007FF6D09E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D09E0000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100323166.00007FF6D09E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100453442.00007FF6D0A0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A22000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100684836.00007FF6D0A24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff6d09e0000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                                        • API String ID: 3215553584-0
                                                                                                                                                                                                                                                        • Opcode ID: 5a303e376ae32d58fd1e52f1ac99a64fdc1cf63549abbe0bdd4da132c2ec767e
                                                                                                                                                                                                                                                        • Instruction ID: 9d1a119f948d68553afad26f395d4f1d26af57d6bf199e851f100e1bc2ac7e36
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 5a303e376ae32d58fd1e52f1ac99a64fdc1cf63549abbe0bdd4da132c2ec767e
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 0D41E57291824193EA34DE19E84017D7BA8EB59798F142132F79ECB7DACF6CE412CB50
                                                                                                                                                                                                                                                        Function 00007FF6D09E7F90 Relevance: 1.6, APIs: 1, Instructions: 85COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2100369578.00007FF6D09E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D09E0000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100323166.00007FF6D09E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100453442.00007FF6D0A0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A22000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100684836.00007FF6D0A24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff6d09e0000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: _fread_nolock
                                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                                        • API String ID: 840049012-0
                                                                                                                                                                                                                                                        • Opcode ID: aaa7b9ff11bb4346a21cc87fb8eff4a238e48d36b47c5124ab7cd44ae98a1b97
                                                                                                                                                                                                                                                        • Instruction ID: 3d69f418cd18ee3511b5fbbee8e612212737a8d7e2ccf49ce56dac2ca010f38a
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: aaa7b9ff11bb4346a21cc87fb8eff4a238e48d36b47c5124ab7cd44ae98a1b97
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 4A21E621B1A69166FA109A6265043FF9645FF85BD8F886432EE1CCF78BCE7DE465C300
                                                                                                                                                                                                                                                        Function 00007FF6D09FB93C Relevance: 1.6, APIs: 1, Instructions: 79COMMONLIBRARYCODE
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2100369578.00007FF6D09E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D09E0000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100323166.00007FF6D09E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100453442.00007FF6D0A0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A22000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100684836.00007FF6D0A24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff6d09e0000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                                        • API String ID: 3215553584-0
                                                                                                                                                                                                                                                        • Opcode ID: c2d01373d3233558d420055387ebca2c39d1ce99b2c1a08127fa32cb0ba5fec2
                                                                                                                                                                                                                                                        • Instruction ID: fb763d096184f6096609c56f848b234e4a8721d18e35551d90ff92ee6913cb1f
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: c2d01373d3233558d420055387ebca2c39d1ce99b2c1a08127fa32cb0ba5fec2
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: AD316562A18602A5F7515F55844137C2E98BF80BACF562137FB1D8B3DBCEBCE4A18711
                                                                                                                                                                                                                                                        Function 00007FF6D09F9961 Relevance: 1.6, APIs: 1, Instructions: 61COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2100369578.00007FF6D09E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D09E0000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100323166.00007FF6D09E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100453442.00007FF6D0A0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A22000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100684836.00007FF6D0A24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff6d09e0000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: HandleModule$AddressFreeLibraryProc
                                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                                        • API String ID: 3947729631-0
                                                                                                                                                                                                                                                        • Opcode ID: 42808d7c08696a35870eb95595f0ae95ff90971c005bfc8769c42bb91e99b0de
                                                                                                                                                                                                                                                        • Instruction ID: 8675644bb67ae835c2af952eb623b1d951ddc7237a84e19c3f491455113bc2df
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 42808d7c08696a35870eb95595f0ae95ff90971c005bfc8769c42bb91e99b0de
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 24218D72A0474599EB248F74C4802EC3BA8EB4471CF44563BE75C8ABCADFB8D5A4C740
                                                                                                                                                                                                                                                        Function 00007FF6D09F5F94 Relevance: 1.6, APIs: 1, Instructions: 55COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2100369578.00007FF6D09E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D09E0000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100323166.00007FF6D09E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100453442.00007FF6D0A0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A22000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100684836.00007FF6D0A24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff6d09e0000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                                        • API String ID: 3215553584-0
                                                                                                                                                                                                                                                        • Opcode ID: d0ecc1d4814c8292f6d285d86e9f4332b8d7141ecd04c52723bb65a1ba9d936a
                                                                                                                                                                                                                                                        • Instruction ID: 9e8442953db5231287fcba82469c70d4002c69b23ab76ef105012a4dc08d40ec
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: d0ecc1d4814c8292f6d285d86e9f4332b8d7141ecd04c52723bb65a1ba9d936a
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: EA117B31A1C64152EA609F51940027D6A68BF85B98F455433FB8CDFB9FCF7DD5604740
                                                                                                                                                                                                                                                        Function 00007FF6D0A06354 Relevance: 1.6, APIs: 1, Instructions: 54COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2100369578.00007FF6D09E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D09E0000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100323166.00007FF6D09E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100453442.00007FF6D0A0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A22000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100684836.00007FF6D0A24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff6d09e0000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                                        • API String ID: 3215553584-0
                                                                                                                                                                                                                                                        • Opcode ID: 3765a10cee1e255344ee37f065f4be71d58868c9c9e645b3056c9746d3493235
                                                                                                                                                                                                                                                        • Instruction ID: 434e2f71a0c8881e63c46c6014e0400c33827d7d5b3eac8177101545670b31b0
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 3765a10cee1e255344ee37f065f4be71d58868c9c9e645b3056c9746d3493235
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 0A21AF33A1CA4696EB648F19D44137D76A0BB84B98F18423AE65DCB7DEDF3DD4218B00
                                                                                                                                                                                                                                                        Function 00007FF6D09F03BC Relevance: 1.5, APIs: 1, Instructions: 48COMMONLIBRARYCODE
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2100369578.00007FF6D09E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D09E0000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100323166.00007FF6D09E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100453442.00007FF6D0A0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A22000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100684836.00007FF6D0A24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff6d09e0000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                                        • API String ID: 3215553584-0
                                                                                                                                                                                                                                                        • Opcode ID: 8e9754deeba93abb4745aa2efb451e77357aefa8fb0fbddb16feb6c8c90fdd62
                                                                                                                                                                                                                                                        • Instruction ID: 5325004799101a7b6e3388f10bea015e248ed98fc6802a3f9c7ecdb748000561
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 8e9754deeba93abb4745aa2efb451e77357aefa8fb0fbddb16feb6c8c90fdd62
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 4F018221A0874550E904DB5259000ADAA99AF85FE8F485632FF6C9BBEFDE3CD4214300
                                                                                                                                                                                                                                                        Function 00007FF6D09F7EFC Relevance: 1.5, APIs: 1, Instructions: 43COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2100369578.00007FF6D09E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D09E0000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100323166.00007FF6D09E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100453442.00007FF6D0A0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A22000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100684836.00007FF6D0A24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff6d09e0000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                                        • API String ID: 3215553584-0
                                                                                                                                                                                                                                                        • Opcode ID: eb4e03bbc0b04cbc85d5aa4284f536322b5632f0a5d263bd1b62b358e696f9c3
                                                                                                                                                                                                                                                        • Instruction ID: 0ac7ffadda9cbd4bc3b5a681f70f1376822896dad8c4e8b9ae193989944980f6
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: eb4e03bbc0b04cbc85d5aa4284f536322b5632f0a5d263bd1b62b358e696f9c3
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 17018021E1D64370FA645B62654117DA998AF447D8F986637FA2CCA7CFDF2CE4B18200
                                                                                                                                                                                                                                                        Function 00007FF6D09F8238 Relevance: 1.5, APIs: 1, Instructions: 19COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2100369578.00007FF6D09E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D09E0000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100323166.00007FF6D09E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100453442.00007FF6D0A0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A22000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100684836.00007FF6D0A24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff6d09e0000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                                        • API String ID: 3215553584-0
                                                                                                                                                                                                                                                        • Opcode ID: 3541b91b086c77dfe17527b78ee7977ece0d5fdea915d925a3ffaee66e22a6c2
                                                                                                                                                                                                                                                        • Instruction ID: a28ff57cc0811e68eb3f6b0547429786628e47736d3ca5d9b3ac3d9b8f22bb51
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 3541b91b086c77dfe17527b78ee7977ece0d5fdea915d925a3ffaee66e22a6c2
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 98E08CA0F9C602A7FA913AA804821BE1C288F95388F402033F9188E3CBDD2C78645321
                                                                                                                                                                                                                                                        Function 00007FF6D09FEB98 Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        • HeapAlloc.KERNEL32(?,?,00000000,00007FF6D09FB32A,?,?,?,00007FF6D09F4F11,?,?,?,?,00007FF6D09FA48A), ref: 00007FF6D09FEBED
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2100369578.00007FF6D09E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D09E0000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100323166.00007FF6D09E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100453442.00007FF6D0A0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A22000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100684836.00007FF6D0A24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff6d09e0000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: AllocHeap
                                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                                        • API String ID: 4292702814-0
                                                                                                                                                                                                                                                        • Opcode ID: 0190c006dd090f1dc8136ef035d08a675b61e1fdbed98732a32380f018d60316
                                                                                                                                                                                                                                                        • Instruction ID: 9b835dfc070e16cfd5bbeeda1acce39f72b1e0853bbc837d3a74069c65981a41
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 0190c006dd090f1dc8136ef035d08a675b61e1fdbed98732a32380f018d60316
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: C8F06D55F19247A1FE6896A798512BC0A885F89B89F4C6533E90FCE3DFED1CE4A04210
                                                                                                                                                                                                                                                        Function 00007FF6D09FD5FC Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        • HeapAlloc.KERNEL32(?,?,?,00007FF6D09F0C90,?,?,?,00007FF6D09F22FA,?,?,?,?,?,00007FF6D09F3AE9), ref: 00007FF6D09FD63A
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2100369578.00007FF6D09E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D09E0000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100323166.00007FF6D09E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100453442.00007FF6D0A0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A22000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100684836.00007FF6D0A24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff6d09e0000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: AllocHeap
                                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                                        • API String ID: 4292702814-0
                                                                                                                                                                                                                                                        • Opcode ID: 510c613edcbd96140e332c46b5608733b20d975e117422ad796dc4540c81bb80
                                                                                                                                                                                                                                                        • Instruction ID: 6d0ff445d41f350033e12147ef29b67f42d042f3b87a66b90b452c3b07a2b65c
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 510c613edcbd96140e332c46b5608733b20d975e117422ad796dc4540c81bb80
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: E7F05E11F1E206A5FE645772580127C19994F857A8F182732FC2ECD3CBDD2CA4A08210

                                                                                                                                                                                                                                                        Non-executed Functions

                                                                                                                                                                                                                                                        Function 00007FF6D09E76C0 Relevance: 177.1, APIs: 66, Strings: 35, Instructions: 314libraryloaderCOMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2100369578.00007FF6D09E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D09E0000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100323166.00007FF6D09E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100453442.00007FF6D0A0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A22000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100684836.00007FF6D0A24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff6d09e0000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: AddressErrorLastProc
                                                                                                                                                                                                                                                        • String ID: Failed to get address for %hs$GetProcAddress$Tcl_Alloc$Tcl_ConditionFinalize$Tcl_ConditionNotify$Tcl_ConditionWait$Tcl_CreateInterp$Tcl_CreateObjCommand$Tcl_CreateThread$Tcl_DeleteInterp$Tcl_DoOneEvent$Tcl_EvalEx$Tcl_EvalFile$Tcl_EvalObjv$Tcl_Finalize$Tcl_FinalizeThread$Tcl_FindExecutable$Tcl_Free$Tcl_GetCurrentThread$Tcl_GetObjResult$Tcl_GetString$Tcl_GetVar2$Tcl_Init$Tcl_JoinThread$Tcl_MutexFinalize$Tcl_MutexLock$Tcl_MutexUnlock$Tcl_NewByteArrayObj$Tcl_NewStringObj$Tcl_SetVar2$Tcl_SetVar2Ex$Tcl_ThreadAlert$Tcl_ThreadQueueEvent$Tk_GetNumMainWindows$Tk_Init
                                                                                                                                                                                                                                                        • API String ID: 199729137-3427451314
                                                                                                                                                                                                                                                        • Opcode ID: 939c8a0ebf27c7f5789cd4a10996167767bc86255d761b2ba34a42bc6fc861e3
                                                                                                                                                                                                                                                        • Instruction ID: f85d3dd4cba74a3b22ae46ed69f3d01e76b3df4dfb1e6a7d1d0a6f9d7cb98fe5
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 939c8a0ebf27c7f5789cd4a10996167767bc86255d761b2ba34a42bc6fc861e3
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: F502C926D1EB0BB0EA1C9F56A91057D2361BF14748F486437E42EC636EEF3CB5798202
                                                                                                                                                                                                                                                        Function 00007FF6D0A040AC Relevance: 24.0, APIs: 9, Strings: 4, Instructions: 1226COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2100369578.00007FF6D09E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D09E0000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100323166.00007FF6D09E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100453442.00007FF6D0A0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A22000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100684836.00007FF6D0A24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff6d09e0000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: _invalid_parameter_noinfo$memcpy_s$fegetenv
                                                                                                                                                                                                                                                        • String ID: 1#IND$1#INF$1#QNAN$1#SNAN
                                                                                                                                                                                                                                                        • API String ID: 808467561-2761157908
                                                                                                                                                                                                                                                        • Opcode ID: 7da0388417e7c773b0aab48e07e342724827a26e5879d16e5decf6c79e081c8c
                                                                                                                                                                                                                                                        • Instruction ID: b37052e6fba0b46de8f219b8fe39704531d91b4dd97a574ed03805e9fba0c4b4
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 7da0388417e7c773b0aab48e07e342724827a26e5879d16e5decf6c79e081c8c
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 0BB2C8B3A1C2879BE7698E66D4407FD37A1FB54384F485136DA0997B8EDF38A910CB40
                                                                                                                                                                                                                                                        Function 00007FF6D09EACAD Relevance: 12.0, Strings: 9, Instructions: 744COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2100369578.00007FF6D09E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D09E0000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100323166.00007FF6D09E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100453442.00007FF6D0A0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A22000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100684836.00007FF6D0A24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff6d09e0000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                                                        • String ID: invalid bit length repeat$invalid code -- missing end-of-block$invalid code lengths set$invalid distance code$invalid distance too far back$invalid distances set$invalid literal/length code$invalid literal/lengths set$too many length or distance symbols
                                                                                                                                                                                                                                                        • API String ID: 0-2665694366
                                                                                                                                                                                                                                                        • Opcode ID: 55880860ec2df9374ed9e05eb7c1f9660e2769407a38999da05ffb99d6c3dc89
                                                                                                                                                                                                                                                        • Instruction ID: 763c93d6e758f3739f6b879ecc1fb33d6edadf0916261e8ac548f2797044366a
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 55880860ec2df9374ed9e05eb7c1f9660e2769407a38999da05ffb99d6c3dc89
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: C95203B2A156A69BD7A48F14C458BBE3BA9FB44344F01513AE64ACB785DF3CEC50CB40
                                                                                                                                                                                                                                                        Function 00007FF6D09ED12C Relevance: 10.6, APIs: 7, Instructions: 71COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2100369578.00007FF6D09E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D09E0000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100323166.00007FF6D09E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100453442.00007FF6D0A0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A22000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100684836.00007FF6D0A24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff6d09e0000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
                                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                                        • API String ID: 3140674995-0
                                                                                                                                                                                                                                                        • Opcode ID: 357b26123f7cc0566be18cabbec560c6351d8abd4e8582c9dfa9d4018571b442
                                                                                                                                                                                                                                                        • Instruction ID: e5a7d78acf47d4cca3ef3b37770b90c310aa98331337032952107d72e9e517ea
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 357b26123f7cc0566be18cabbec560c6351d8abd4e8582c9dfa9d4018571b442
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 7E315072A19B8596EB648F61E8803EE7360FB88748F04403BDA4E87B9DDF78D558C710
                                                                                                                                                                                                                                                        Function 00007FF6D09FA614 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2100369578.00007FF6D09E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D09E0000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100323166.00007FF6D09E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100453442.00007FF6D0A0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A22000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100684836.00007FF6D0A24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff6d09e0000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
                                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                                        • API String ID: 1239891234-0
                                                                                                                                                                                                                                                        • Opcode ID: ae2d74aaff6e8c1310ec24f87c3395aa5518f909cdba62f6f822c67f0a9cc142
                                                                                                                                                                                                                                                        • Instruction ID: 01164f76643cf04e6cf64f917570bbe30e5708b341468d211e4cf37bca445bea
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: ae2d74aaff6e8c1310ec24f87c3395aa5518f909cdba62f6f822c67f0a9cc142
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 5F319F36A18B8596DB24CF25E8402EE73A4FB88758F540136EA8D87B5EDF3CD565CB00
                                                                                                                                                                                                                                                        Function 00007FF6D0A01874 Relevance: 7.8, APIs: 5, Instructions: 282COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2100369578.00007FF6D09E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D09E0000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100323166.00007FF6D09E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100453442.00007FF6D0A0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A22000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100684836.00007FF6D0A24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff6d09e0000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: FileFindFirst_invalid_parameter_noinfo
                                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                                        • API String ID: 2227656907-0
                                                                                                                                                                                                                                                        • Opcode ID: ee5daded1920a45b930385d49f4c9fb7106de6f00b6358014c2482279c1420ad
                                                                                                                                                                                                                                                        • Instruction ID: eee2bf2a92199a3e160dcd84e6d79879ddad396efa7426140bc5b3183f58a0b0
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: ee5daded1920a45b930385d49f4c9fb7106de6f00b6358014c2482279c1420ad
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 1BB1C263B1D68A51EA689B2395101FD6390EB85BE4F485133EE4D87B9EEF3CE461C300
                                                                                                                                                                                                                                                        Function 00007FF6D09ED010 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2100369578.00007FF6D09E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D09E0000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100323166.00007FF6D09E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100453442.00007FF6D0A0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A22000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100684836.00007FF6D0A24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff6d09e0000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
                                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                                        • API String ID: 2933794660-0
                                                                                                                                                                                                                                                        • Opcode ID: 884c9866f0db1ea4ea3e8c559fd458021c8c8106c035f87ab540984eb8a2d97e
                                                                                                                                                                                                                                                        • Instruction ID: 3a7d4d4bf6b9b338870fd84e2a599ffd5de31d547e94989f60c08c71a2b24dbc
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 884c9866f0db1ea4ea3e8c559fd458021c8c8106c035f87ab540984eb8a2d97e
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 7A115E22B58F059AEB00CF61E8542BD33A4FB1D758F080E32DA2D867A9DF7CD5648340
                                                                                                                                                                                                                                                        Function 00007FF6D0A03C10 Relevance: 4.8, APIs: 3, Instructions: 340COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2100369578.00007FF6D09E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D09E0000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100323166.00007FF6D09E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100453442.00007FF6D0A0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A22000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100684836.00007FF6D0A24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff6d09e0000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: memcpy_s
                                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                                        • API String ID: 1502251526-0
                                                                                                                                                                                                                                                        • Opcode ID: 723df14fe8405c9280d13974b9e0b256372cd2939c4def8ecbac686ef57d643c
                                                                                                                                                                                                                                                        • Instruction ID: b678ffac5585db0ada48477211a31cb98b239b161ff4d5f9e8c272166f496b97
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 723df14fe8405c9280d13974b9e0b256372cd2939c4def8ecbac686ef57d643c
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: E7C1C173A1C28A97E738CF16E04466EB795F784B84F488136DB4A9774DDE3DE8118B40
                                                                                                                                                                                                                                                        Function 00007FF6D09EA474 Relevance: 4.1, Strings: 3, Instructions: 398COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2100369578.00007FF6D09E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D09E0000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100323166.00007FF6D09E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100453442.00007FF6D0A0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A22000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100684836.00007FF6D0A24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff6d09e0000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                                                        • String ID: $header crc mismatch$unknown header flags set
                                                                                                                                                                                                                                                        • API String ID: 0-1127688429
                                                                                                                                                                                                                                                        • Opcode ID: fcf6ea83c7a46010d3591867e81b0f53761d3f113121264a3729654d2d1b513f
                                                                                                                                                                                                                                                        • Instruction ID: 9454cb163d682d2b30417878264c9a8951568fc4406f262721145388b2b1a7a8
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: fcf6ea83c7a46010d3591867e81b0f53761d3f113121264a3729654d2d1b513f
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 8EF1A6B2A093D59BE7A58B14C088B7E3AA9FF45748F055536DA49CB3A6CF38EC50C740
                                                                                                                                                                                                                                                        Function 00007FF6D0A09728 Relevance: 3.2, APIs: 2, Instructions: 227COMMONLIBRARYCODE
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2100369578.00007FF6D09E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D09E0000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100323166.00007FF6D09E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100453442.00007FF6D0A0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A22000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100684836.00007FF6D0A24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff6d09e0000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: ExceptionRaise_clrfp
                                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                                        • API String ID: 15204871-0
                                                                                                                                                                                                                                                        • Opcode ID: a4cc0e8a2f7e024105bf8074fef1866164229a93701b52dcf00f6f20498becf3
                                                                                                                                                                                                                                                        • Instruction ID: a5366a0c85b51fe04bdf309e645dbe72de7194d224010b074c78aaa71628ca76
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: a4cc0e8a2f7e024105bf8074fef1866164229a93701b52dcf00f6f20498becf3
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: B4B15F73618B898BE719CF2AC84536C77A0F744B88F188926DA5D837ADCF79D461C700
                                                                                                                                                                                                                                                        Function 00007FF6D09F39A4 Relevance: 2.8, Strings: 2, Instructions: 350COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2100369578.00007FF6D09E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D09E0000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100323166.00007FF6D09E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100453442.00007FF6D0A0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A22000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100684836.00007FF6D0A24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff6d09e0000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                                                        • String ID: $
                                                                                                                                                                                                                                                        • API String ID: 0-227171996
                                                                                                                                                                                                                                                        • Opcode ID: e57f1980f4491aea9eb328a1e81193c2bccc9a7e68d1918bb9b7207cf9600634
                                                                                                                                                                                                                                                        • Instruction ID: 9b3493ec31f820574b1219ce54487d2c6596b1831031305c483ba341ecff186f
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: e57f1980f4491aea9eb328a1e81193c2bccc9a7e68d1918bb9b7207cf9600634
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 0DE18732A0864695DB68CE26815013D3BA8FF45B4CF14A177EE4E8B7DADF2DE861C740
                                                                                                                                                                                                                                                        Function 00007FF6D09EA2DB Relevance: 2.7, Strings: 2, Instructions: 216COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2100369578.00007FF6D09E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D09E0000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100323166.00007FF6D09E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100453442.00007FF6D0A0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A22000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100684836.00007FF6D0A24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff6d09e0000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                                                        • String ID: incorrect header check$invalid window size
                                                                                                                                                                                                                                                        • API String ID: 0-900081337
                                                                                                                                                                                                                                                        • Opcode ID: 7e7bac63e97a7e962ac1d8bc37368dc0e110af78d4507200a91f80e7c7b94e68
                                                                                                                                                                                                                                                        • Instruction ID: ac13b207a9cc6ee6b77070eb5c853ed010ba844b54a2b9ff33e6e69488fdcaf1
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 7e7bac63e97a7e962ac1d8bc37368dc0e110af78d4507200a91f80e7c7b94e68
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: FF91B9B2A092C697E7A48B14C448B7E3A99FF44358F115136DA49CA7DADF38ED50CB40
                                                                                                                                                                                                                                                        Function 00007FF6D09FDEF0 Relevance: 2.6, Strings: 2, Instructions: 144COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2100369578.00007FF6D09E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D09E0000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100323166.00007FF6D09E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100453442.00007FF6D0A0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A22000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100684836.00007FF6D0A24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff6d09e0000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                                                        • String ID: e+000$gfff
                                                                                                                                                                                                                                                        • API String ID: 0-3030954782
                                                                                                                                                                                                                                                        • Opcode ID: c8a24eaff8c968987b4d031b15ae93849e98bcf9eddb8930961e84febef9b5bc
                                                                                                                                                                                                                                                        • Instruction ID: af64a2d453d322f6fad8c1b609df2582b827b895997f5b769da4a4e78deb5fae
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: c8a24eaff8c968987b4d031b15ae93849e98bcf9eddb8930961e84febef9b5bc
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 8D517762F2C2C556E7258E35980076D6F95E744B98F4CA232EB988BBCACF7DD4108701
                                                                                                                                                                                                                                                        Function 00007FF6D09FDA5C Relevance: 1.5, Strings: 1, Instructions: 254COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2100369578.00007FF6D09E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D09E0000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100323166.00007FF6D09E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100453442.00007FF6D0A0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A22000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100684836.00007FF6D0A24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff6d09e0000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                                                        • String ID: gfffffff
                                                                                                                                                                                                                                                        • API String ID: 0-1523873471
                                                                                                                                                                                                                                                        • Opcode ID: bcab6200947a377332474fa44b4677218d40dcace4b26705986274372b0e4f91
                                                                                                                                                                                                                                                        • Instruction ID: dbabfc7e7f31951160b6d53f24e22668e87749af86468799291307bb9021bb25
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: bcab6200947a377332474fa44b4677218d40dcace4b26705986274372b0e4f91
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 96A15962E0A7C956EB21CF25A4007AD7B9AEB50788F059132EE8D8B7CADE3DD511C701
                                                                                                                                                                                                                                                        Function 00007FF6D09F8794 Relevance: 1.4, Strings: 1, Instructions: 177COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2100369578.00007FF6D09E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D09E0000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100323166.00007FF6D09E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100453442.00007FF6D0A0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A22000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100684836.00007FF6D0A24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff6d09e0000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                                        • String ID: TMP
                                                                                                                                                                                                                                                        • API String ID: 3215553584-3125297090
                                                                                                                                                                                                                                                        • Opcode ID: 09cdd7cf7fc9e7e425d724a32e8c9d3bd5c12dba7606eca5b930980d9b4d1239
                                                                                                                                                                                                                                                        • Instruction ID: 760f22206c66d5e653fe1085dc5dcd2cf090b288e51aee9d77cefa2a690d8ee9
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 09cdd7cf7fc9e7e425d724a32e8c9d3bd5c12dba7606eca5b930980d9b4d1239
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: BD519511F4860261FA989627590117F5A98EF84BDCF586436ED1ECB79FEE7CE4714200
                                                                                                                                                                                                                                                        Function 00007FF6D0A03480 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2100369578.00007FF6D09E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D09E0000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100323166.00007FF6D09E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100453442.00007FF6D0A0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A22000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100684836.00007FF6D0A24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff6d09e0000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: HeapProcess
                                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                                        • API String ID: 54951025-0
                                                                                                                                                                                                                                                        • Opcode ID: 1f9e0516fd534d967cb731c121838b59470578846d262458ea046ba55ab40ebf
                                                                                                                                                                                                                                                        • Instruction ID: e9971f578c57b038da3a4c4ef837641a58b07469304f6b8759ea122b736fe775
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 1f9e0516fd534d967cb731c121838b59470578846d262458ea046ba55ab40ebf
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 36B09222E2BA06E2EA0C6B226C8226C22A47F58700F9C013AC00C8433AEE2C20F55700
                                                                                                                                                                                                                                                        Function 00007FF6D09F35A0 Relevance: .3, Instructions: 327COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2100369578.00007FF6D09E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D09E0000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100323166.00007FF6D09E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100453442.00007FF6D0A0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A22000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100684836.00007FF6D0A24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff6d09e0000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                                                        • Opcode ID: 5eca4e5ff3e7205525bf20f3b63783aa462e3e7adb0228d62bb7e98ab9f5e9bb
                                                                                                                                                                                                                                                        • Instruction ID: 98d0bdfdb4b38cbb241117ea08d053fda2095891c7225332005a66f832f6514a
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 5eca4e5ff3e7205525bf20f3b63783aa462e3e7adb0228d62bb7e98ab9f5e9bb
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: E2D1B962A08642A5EB68CE25804127D2BA8EF05B4CF14A277ED0DCB7DEDF7DD865C740
                                                                                                                                                                                                                                                        Function 00007FF6D09E9800 Relevance: .3, Instructions: 287COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2100369578.00007FF6D09E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D09E0000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100323166.00007FF6D09E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100453442.00007FF6D0A0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A22000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100684836.00007FF6D0A24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff6d09e0000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                                                        • Opcode ID: e75d751cc15dfd510e55d83c6141b0e8cb11d18cbed01e0c543b372a0114c593
                                                                                                                                                                                                                                                        • Instruction ID: 9e38c9f18e357d8601d0a12dded826f2781e9863f072bee9c00e404d18ed7b5d
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: e75d751cc15dfd510e55d83c6141b0e8cb11d18cbed01e0c543b372a0114c593
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: D8C1BF722181E08BD289EB29E46947A73D1F78930EB95506BEF87877C6CB3CA514DB10
                                                                                                                                                                                                                                                        Function 00007FF6D09F2C10 Relevance: .2, Instructions: 241COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2100369578.00007FF6D09E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D09E0000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100323166.00007FF6D09E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100453442.00007FF6D0A0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A22000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100684836.00007FF6D0A24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff6d09e0000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                                                        • Opcode ID: aa73bfa000bc8cd66a05f12d530b76a597660d7bda6a6781f52cf2f49ffced0b
                                                                                                                                                                                                                                                        • Instruction ID: c514f05ecd695e2c36723be593c2a472dac5369b18015b22746a11ed686b8b6c
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: aa73bfa000bc8cd66a05f12d530b76a597660d7bda6a6781f52cf2f49ffced0b
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: CCB19D72918B8596E764CF29C05027C3FA8EB49F4CF256136EA4E8B39ACF39D461C741
                                                                                                                                                                                                                                                        Function 00007FF6D09FE570 Relevance: .2, Instructions: 198COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2100369578.00007FF6D09E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D09E0000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100323166.00007FF6D09E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100453442.00007FF6D0A0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A22000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100684836.00007FF6D0A24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff6d09e0000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                                                        • Opcode ID: 9611c2e0762efa78d7f6da3d8515592aa8d86601c49200b7335873453b670326
                                                                                                                                                                                                                                                        • Instruction ID: 217b6324b885023d060a94899628814894b87fc5f9eeef7041dec22fa4602669
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 9611c2e0762efa78d7f6da3d8515592aa8d86601c49200b7335873453b670326
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 6381D372A0878556EB74CF19944037E6E95FB55798F145236EA8D8BB8EDF3CE4208B00
                                                                                                                                                                                                                                                        Function 00007FF6D0A06418 Relevance: .2, Instructions: 183COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2100369578.00007FF6D09E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D09E0000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100323166.00007FF6D09E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100453442.00007FF6D0A0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A22000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100684836.00007FF6D0A24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff6d09e0000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                                        • API String ID: 3215553584-0
                                                                                                                                                                                                                                                        • Opcode ID: 21aaab296e2e64a79b20cf98ea2699a9ab0529386423cc159892306e5cd43e00
                                                                                                                                                                                                                                                        • Instruction ID: 97f773fb86b6c4aa68681e280c1befcc780d30d20e47452508f5ab05bb886c98
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 21aaab296e2e64a79b20cf98ea2699a9ab0529386423cc159892306e5cd43e00
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 8B61E923E1C25666F76C8A7A945267D6680AF40768F1C423FE61DC77CFDE6EE8208700
                                                                                                                                                                                                                                                        Function 00007FF6D09F2164 Relevance: .1, Instructions: 146COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2100369578.00007FF6D09E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D09E0000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100323166.00007FF6D09E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100453442.00007FF6D0A0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A22000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100684836.00007FF6D0A24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff6d09e0000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                                                        • Opcode ID: 8e69dfdcc94a0aa650623f7423aa354004c1f2fa01d5c1268249020d4c21f447
                                                                                                                                                                                                                                                        • Instruction ID: f45874384e44c1415b16ee81b36cc1cc75a323cf5467760f30415b8453ca8e4b
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 8e69dfdcc94a0aa650623f7423aa354004c1f2fa01d5c1268249020d4c21f447
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 18519876A1865191E7248B29C44037C3BA5EB54F5CF246132DE5D8B79ACF3AE863C740
                                                                                                                                                                                                                                                        Function 00007FF6D09F1944 Relevance: .1, Instructions: 146COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2100369578.00007FF6D09E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D09E0000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100323166.00007FF6D09E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100453442.00007FF6D0A0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A22000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100684836.00007FF6D0A24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff6d09e0000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                                                        • Opcode ID: 68a3f5aab59b2fac328bd6ba34d5b1cd1fa94c6914f84dc4a79da3b9d8ff9a98
                                                                                                                                                                                                                                                        • Instruction ID: b872ec14779c73f6f314310c5c98cae9f5e63e179a7e53ea5199a1c48831d559
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 68a3f5aab59b2fac328bd6ba34d5b1cd1fa94c6914f84dc4a79da3b9d8ff9a98
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: F1519636A1565191E7248B29D05023C3BB4EB44F5CF246136EA8D9B79ECF7AE863C7C0
                                                                                                                                                                                                                                                        Function 00007FF6D09F1D54 Relevance: .1, Instructions: 146COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2100369578.00007FF6D09E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D09E0000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100323166.00007FF6D09E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100453442.00007FF6D0A0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A22000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100684836.00007FF6D0A24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff6d09e0000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                                                        • Opcode ID: 27099d1c67046ba5536a5c52bb1b19252402c8bb4a5167aa336477e7b6d5f807
                                                                                                                                                                                                                                                        • Instruction ID: 5e2beabc7f03a6cb954a06af970d8da95fe0aabe68b3dd5fa6212f615b82da8f
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 27099d1c67046ba5536a5c52bb1b19252402c8bb4a5167aa336477e7b6d5f807
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: B0518B76A1865192E7248B19C04037C3BB4EB55B5CF245136EE4D9B7DACF3AE863C780
                                                                                                                                                                                                                                                        Function 00007FF6D09F1B50 Relevance: .1, Instructions: 145COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2100369578.00007FF6D09E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D09E0000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100323166.00007FF6D09E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100453442.00007FF6D0A0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A22000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100684836.00007FF6D0A24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff6d09e0000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                                                        • Opcode ID: dc981bf603441a130e1c6ba5e96f77be0c3c60e19ec03e3d560a09712d731568
                                                                                                                                                                                                                                                        • Instruction ID: 576154b454237bf109a40397193eee9779b590b22f0488b45997e77f0771aa1b
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: dc981bf603441a130e1c6ba5e96f77be0c3c60e19ec03e3d560a09712d731568
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: B1519636A18651D5E7248F29C05023C2BB5EB45B5CF246132EE4C9B79EDF3AE863C780
                                                                                                                                                                                                                                                        Function 00007FF6D09F1F60 Relevance: .1, Instructions: 145COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2100369578.00007FF6D09E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D09E0000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100323166.00007FF6D09E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100453442.00007FF6D0A0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A22000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100684836.00007FF6D0A24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff6d09e0000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                                                        • Opcode ID: e734bc54909bdf7d9c6fd1772be64da5dc64d4f5bf3044a39ac3ba7850561882
                                                                                                                                                                                                                                                        • Instruction ID: dd63e1ba6ba61e26be09e650a854f9349c8e67a7d09bf44691cb2884bff5e806
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: e734bc54909bdf7d9c6fd1772be64da5dc64d4f5bf3044a39ac3ba7850561882
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: B451873671865195E7248B29C04033C3BA4EB45B5CF285132EE4D9B79ECF3AE863C780
                                                                                                                                                                                                                                                        Function 00007FF6D09F1740 Relevance: .1, Instructions: 145COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2100369578.00007FF6D09E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D09E0000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100323166.00007FF6D09E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100453442.00007FF6D0A0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A22000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100684836.00007FF6D0A24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff6d09e0000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                                                        • Opcode ID: 3943df286285c50b07f09d339b53caaa0afa34ddfac4fad96d8a3f7ffd6ad23b
                                                                                                                                                                                                                                                        • Instruction ID: e199d47c8a7d1c81079de2327799e338a4ba936e9a0cba01c5d8de63bcdf6589
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 3943df286285c50b07f09d339b53caaa0afa34ddfac4fad96d8a3f7ffd6ad23b
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 8E516776A1465195E7248B29C04023C3BB5EB45B5CF246132DE4D9B79ECF3AE863D7C0
                                                                                                                                                                                                                                                        Function 00007FF6D09F5D30 Relevance: .1, Instructions: 138COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2100369578.00007FF6D09E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D09E0000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100323166.00007FF6D09E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100453442.00007FF6D0A0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A22000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100684836.00007FF6D0A24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff6d09e0000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                                                        • Opcode ID: dde3b7cfbcf26fc8d7513faefc9a59c4b8821272907dfbb35b6db6355186da00
                                                                                                                                                                                                                                                        • Instruction ID: 19a314aa7250e66667ad86feea898145758a19df2210243f985ab15c5aff6724
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: dde3b7cfbcf26fc8d7513faefc9a59c4b8821272907dfbb35b6db6355186da00
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: E8419662C4F74A35E9998918050C6BC1E889F127B8D5872B6FF9D9F3DBCD0D66A7C100
                                                                                                                                                                                                                                                        Function 00007FF6D09F9EA0 Relevance: .1, Instructions: 126COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2100369578.00007FF6D09E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D09E0000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100323166.00007FF6D09E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100453442.00007FF6D0A0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A22000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100684836.00007FF6D0A24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff6d09e0000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: ErrorFreeHeapLast
                                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                                        • API String ID: 485612231-0
                                                                                                                                                                                                                                                        • Opcode ID: 1c7003d4bfacf113f63307708dabd17e5ede6cda44dccf6aa27d02a6b9ea0481
                                                                                                                                                                                                                                                        • Instruction ID: 8fe17498757f839c9a6e375f372d3ea7910279e5ce3101ab76e20e35df1e90d0
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 1c7003d4bfacf113f63307708dabd17e5ede6cda44dccf6aa27d02a6b9ea0481
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 8B412263714A5592EF08CF2AE9141ADB7A5BB48FD4B09A033EE0DDBB59DE7CD4528300
                                                                                                                                                                                                                                                        Function 00007FF6D09F80E4 Relevance: .1, Instructions: 98COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2100369578.00007FF6D09E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D09E0000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100323166.00007FF6D09E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100453442.00007FF6D0A0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A22000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100684836.00007FF6D0A24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff6d09e0000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                                                        • Opcode ID: 2b8cddb4ee5dd57f1c7573491c8f445712dd312cb7e9e547cfd0f9c072f4c0c7
                                                                                                                                                                                                                                                        • Instruction ID: 3498394fc173d736e4bf41a9d6b1a4fcc6fb2fc00007905e9d6b97df348d24e3
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 2b8cddb4ee5dd57f1c7573491c8f445712dd312cb7e9e547cfd0f9c072f4c0c7
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 7231D232B1CB4241E7A49F26644017E6AD8EB84BD4F14523AFA5D97BDADF3CE0228704
                                                                                                                                                                                                                                                        Function 00007FF6D0A09570 Relevance: .0, Instructions: 32COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2100369578.00007FF6D09E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D09E0000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100323166.00007FF6D09E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100453442.00007FF6D0A0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A22000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100684836.00007FF6D0A24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff6d09e0000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                                                        • Opcode ID: 5d3ac10822f6242d2b374fc0e1218152d8e80c351f0dfcd4fab21387456caa74
                                                                                                                                                                                                                                                        • Instruction ID: 43b8fd4a6674c615d1ae0f715206080dad25256034e6f9b6440237297166957b
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 5d3ac10822f6242d2b374fc0e1218152d8e80c351f0dfcd4fab21387456caa74
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 61F044737186959ADBACCF6AA80262977D0F708380F44943AD58DC7B18DE3CD1619F04
                                                                                                                                                                                                                                                        Function 00007FF6D09ED30C Relevance: .0, Instructions: 2COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2100369578.00007FF6D09E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D09E0000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100323166.00007FF6D09E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100453442.00007FF6D0A0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A22000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100684836.00007FF6D0A24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff6d09e0000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                                                        • Opcode ID: 3c3909751b2697c6481bc0460501d6177e5cf72f77169ad8285d6e0cd944102a
                                                                                                                                                                                                                                                        • Instruction ID: b443afdfac9f47b445e3c39417198e183872a18b56f4d5c648f3245677d4e471
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 3c3909751b2697c6481bc0460501d6177e5cf72f77169ad8285d6e0cd944102a
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 0DA00122D1E80AE0E6488B01A9900692220BB69348B842033E00DD52AADE2CA8249201
                                                                                                                                                                                                                                                        Function 00007FF6D09E5830 Relevance: 229.6, APIs: 86, Strings: 45, Instructions: 400libraryloaderCOMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        • GetProcAddress.KERNEL32(?,00007FF6D09E64CF,?,00007FF6D09E336E), ref: 00007FF6D09E5840
                                                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,00007FF6D09E64CF,?,00007FF6D09E336E), ref: 00007FF6D09E5852
                                                                                                                                                                                                                                                        • GetProcAddress.KERNEL32(?,00007FF6D09E64CF,?,00007FF6D09E336E), ref: 00007FF6D09E5889
                                                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,00007FF6D09E64CF,?,00007FF6D09E336E), ref: 00007FF6D09E589B
                                                                                                                                                                                                                                                        • GetProcAddress.KERNEL32(?,00007FF6D09E64CF,?,00007FF6D09E336E), ref: 00007FF6D09E58B4
                                                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,00007FF6D09E64CF,?,00007FF6D09E336E), ref: 00007FF6D09E58C6
                                                                                                                                                                                                                                                        • GetProcAddress.KERNEL32(?,00007FF6D09E64CF,?,00007FF6D09E336E), ref: 00007FF6D09E58DF
                                                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,00007FF6D09E64CF,?,00007FF6D09E336E), ref: 00007FF6D09E58F1
                                                                                                                                                                                                                                                        • GetProcAddress.KERNEL32(?,00007FF6D09E64CF,?,00007FF6D09E336E), ref: 00007FF6D09E590D
                                                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,00007FF6D09E64CF,?,00007FF6D09E336E), ref: 00007FF6D09E591F
                                                                                                                                                                                                                                                        • GetProcAddress.KERNEL32(?,00007FF6D09E64CF,?,00007FF6D09E336E), ref: 00007FF6D09E593B
                                                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,00007FF6D09E64CF,?,00007FF6D09E336E), ref: 00007FF6D09E594D
                                                                                                                                                                                                                                                        • GetProcAddress.KERNEL32(?,00007FF6D09E64CF,?,00007FF6D09E336E), ref: 00007FF6D09E5969
                                                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,00007FF6D09E64CF,?,00007FF6D09E336E), ref: 00007FF6D09E597B
                                                                                                                                                                                                                                                        • GetProcAddress.KERNEL32(?,00007FF6D09E64CF,?,00007FF6D09E336E), ref: 00007FF6D09E5997
                                                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,00007FF6D09E64CF,?,00007FF6D09E336E), ref: 00007FF6D09E59A9
                                                                                                                                                                                                                                                        • GetProcAddress.KERNEL32(?,00007FF6D09E64CF,?,00007FF6D09E336E), ref: 00007FF6D09E59C5
                                                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,00007FF6D09E64CF,?,00007FF6D09E336E), ref: 00007FF6D09E59D7
                                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2100369578.00007FF6D09E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D09E0000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100323166.00007FF6D09E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100453442.00007FF6D0A0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A22000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100684836.00007FF6D0A24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff6d09e0000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: AddressErrorLastProc
                                                                                                                                                                                                                                                        • String ID: Failed to get address for %hs$GetProcAddress$PyConfig_Clear$PyConfig_InitIsolatedConfig$PyConfig_Read$PyConfig_SetBytesString$PyConfig_SetString$PyConfig_SetWideStringList$PyErr_Clear$PyErr_Fetch$PyErr_NormalizeException$PyErr_Occurred$PyErr_Print$PyErr_Restore$PyEval_EvalCode$PyImport_AddModule$PyImport_ExecCodeModule$PyImport_ImportModule$PyMarshal_ReadObjectFromString$PyMem_RawFree$PyModule_GetDict$PyObject_CallFunction$PyObject_CallFunctionObjArgs$PyObject_GetAttrString$PyObject_SetAttrString$PyObject_Str$PyPreConfig_InitIsolatedConfig$PyRun_SimpleStringFlags$PyStatus_Exception$PySys_GetObject$PySys_SetObject$PyUnicode_AsUTF8$PyUnicode_Decode$PyUnicode_DecodeFSDefault$PyUnicode_FromFormat$PyUnicode_FromString$PyUnicode_Join$PyUnicode_Replace$Py_DecRef$Py_DecodeLocale$Py_ExitStatusException$Py_Finalize$Py_InitializeFromConfig$Py_IsInitialized$Py_PreInitialize
                                                                                                                                                                                                                                                        • API String ID: 199729137-653951865
                                                                                                                                                                                                                                                        • Opcode ID: a72b1b0889ffc37889110ad0e4f068dcb4eb8b0bbe2e77bf2d8672c26fae6e03
                                                                                                                                                                                                                                                        • Instruction ID: 8b30f166ee3875d84d8d9d4d2ea7cf86673d01466349087cd806e2f8a5776fbc
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: a72b1b0889ffc37889110ad0e4f068dcb4eb8b0bbe2e77bf2d8672c26fae6e03
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 0222AA6691EB0BB1FA18DF56A85057D22A0BF14755F496037C81EC63AFFF3CA9788200
                                                                                                                                                                                                                                                        Function 00007FF6D09E81D0 Relevance: 24.6, APIs: 6, Strings: 8, Instructions: 117COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                          • Part of subcall function 00007FF6D09E9390: MultiByteToWideChar.KERNEL32(?,?,?,00007FF6D09E45F4,00000000,00007FF6D09E1985), ref: 00007FF6D09E93C9
                                                                                                                                                                                                                                                        • ExpandEnvironmentStringsW.KERNEL32(?,00007FF6D09E86B7,?,?,00000000,00007FF6D09E3CBB), ref: 00007FF6D09E822C
                                                                                                                                                                                                                                                          • Part of subcall function 00007FF6D09E2810: MessageBoxW.USER32 ref: 00007FF6D09E28EA
                                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2100369578.00007FF6D09E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D09E0000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100323166.00007FF6D09E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100453442.00007FF6D0A0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A22000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100684836.00007FF6D0A24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff6d09e0000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: ByteCharEnvironmentExpandMessageMultiStringsWide
                                                                                                                                                                                                                                                        • String ID: %.*s$CreateDirectory$LOADER: failed to convert runtime-tmpdir to a wide string.$LOADER: failed to create runtime-tmpdir path %ls!$LOADER: failed to expand environment variables in the runtime-tmpdir.$LOADER: failed to obtain the absolute path of the runtime-tmpdir.$LOADER: runtime-tmpdir points to non-existent drive %ls (type: %d)!$\
                                                                                                                                                                                                                                                        • API String ID: 1662231829-930877121
                                                                                                                                                                                                                                                        • Opcode ID: 9187bed43bf71c5340eadf58a1920dd2feb36a2730cc38c17813087cef3183ed
                                                                                                                                                                                                                                                        • Instruction ID: 9705a7f41a3778bbe20a72b0e9e0d87a4b2783617791c49f8b6f252c7d71e208
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 9187bed43bf71c5340eadf58a1920dd2feb36a2730cc38c17813087cef3183ed
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 3251B922A2E64271FA549B65D9512BF6350FF44788F446433E61ECA7DFEE7CE8248300
                                                                                                                                                                                                                                                        Function 00007FF6D09E2180 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 120COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2100369578.00007FF6D09E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D09E0000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100323166.00007FF6D09E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100453442.00007FF6D0A0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A22000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100684836.00007FF6D0A24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff6d09e0000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: MoveWindow$ObjectSelect$DrawReleaseText
                                                                                                                                                                                                                                                        • String ID: P%
                                                                                                                                                                                                                                                        • API String ID: 2147705588-2959514604
                                                                                                                                                                                                                                                        • Opcode ID: 044398bc2faddcfc72e28419b1c607044beef288ba0900b5e0371f537bcab75f
                                                                                                                                                                                                                                                        • Instruction ID: b1addf4061d0eb3cda5b0457c4acc114c4cd96d2f3579ae798734626181f88cc
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 044398bc2faddcfc72e28419b1c607044beef288ba0900b5e0371f537bcab75f
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: A05129266187A186D6389F22E4181BEB7A1F798B61F004132EFDE8379ADF3CD155CB10
                                                                                                                                                                                                                                                        Function 00007FF6D09E80C0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 67COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2100369578.00007FF6D09E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D09E0000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100323166.00007FF6D09E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100453442.00007FF6D0A0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A22000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100684836.00007FF6D0A24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff6d09e0000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: LongWindow$BlockCreateErrorLastReasonShutdown
                                                                                                                                                                                                                                                        • String ID: Needs to remove its temporary files.
                                                                                                                                                                                                                                                        • API String ID: 3975851968-2863640275
                                                                                                                                                                                                                                                        • Opcode ID: fca9629812ae98fc4dea80e51924cd1fa5b6a95a0379263e815d251d6ca0a567
                                                                                                                                                                                                                                                        • Instruction ID: 59050b9f57aab5cb76b3963ba2b780087d204e742b0c56bb176720d3029d2755
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: fca9629812ae98fc4dea80e51924cd1fa5b6a95a0379263e815d251d6ca0a567
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 6C210722B1DA46A1E7458BBBE95417E6250FF88B94F0C5233DA2DC73DEDE2CD9618300
                                                                                                                                                                                                                                                        Function 00007FF6D09F6290 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 494COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2100369578.00007FF6D09E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D09E0000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100323166.00007FF6D09E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100453442.00007FF6D0A0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A22000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100684836.00007FF6D0A24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff6d09e0000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                                        • String ID: -$:$f$p$p
                                                                                                                                                                                                                                                        • API String ID: 3215553584-2013873522
                                                                                                                                                                                                                                                        • Opcode ID: 75ce3dd5e90789a751ac91fed3db50e3550f512a2f4dec46f6fb30c565ad9a60
                                                                                                                                                                                                                                                        • Instruction ID: 93bf2863a7451f37dd87cc806eb78b9aa8d4fdca1bef1a578f42f4b12263e55c
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 75ce3dd5e90789a751ac91fed3db50e3550f512a2f4dec46f6fb30c565ad9a60
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 69129362E0C343A6FB205A14D15427E7A69FB90758F94513BF689CA7CEDF3CE5A08B00
                                                                                                                                                                                                                                                        Function 00007FF6D09F0FC8 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 475COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2100369578.00007FF6D09E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D09E0000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100323166.00007FF6D09E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100453442.00007FF6D0A0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A22000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100684836.00007FF6D0A24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff6d09e0000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                                        • String ID: f$f$p$p$f
                                                                                                                                                                                                                                                        • API String ID: 3215553584-1325933183
                                                                                                                                                                                                                                                        • Opcode ID: efdc55b57c7b5823aa39a5abe82f144bbffe385c3037011f7a836833ec2ff017
                                                                                                                                                                                                                                                        • Instruction ID: f0b21b7929651b5454ab6f70b9ff06c158c708ca9e312cc6b83c079d9327b605
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: efdc55b57c7b5823aa39a5abe82f144bbffe385c3037011f7a836833ec2ff017
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 36129661E1C143A6FB245A14E05467D7AB9FB80758F845037F69A8BBCDDF7CE4A08B80
                                                                                                                                                                                                                                                        Function 00007FF6D09E1050 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 119COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2100369578.00007FF6D09E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D09E0000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100323166.00007FF6D09E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100453442.00007FF6D0A0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A22000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100684836.00007FF6D0A24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff6d09e0000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: CurrentProcess
                                                                                                                                                                                                                                                        • String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
                                                                                                                                                                                                                                                        • API String ID: 2050909247-3659356012
                                                                                                                                                                                                                                                        • Opcode ID: b86492fec82845683ed30ee17fa4372ac3c9e67344e1de42683d38f875b626aa
                                                                                                                                                                                                                                                        • Instruction ID: 1cffdf1a5980c737c337fbdb2fc56015da774ca7f201d3a5dc52d21146064a48
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: b86492fec82845683ed30ee17fa4372ac3c9e67344e1de42683d38f875b626aa
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 27418222B1D652A2EA14DB12A9006BD6794FF44BC8F446433EE0CCB79FDE3CE9258740
                                                                                                                                                                                                                                                        Function 00007FF6D09E1470 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 107COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2100369578.00007FF6D09E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D09E0000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100323166.00007FF6D09E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100453442.00007FF6D0A0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A22000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100684836.00007FF6D0A24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff6d09e0000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: CurrentProcess
                                                                                                                                                                                                                                                        • String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
                                                                                                                                                                                                                                                        • API String ID: 2050909247-3659356012
                                                                                                                                                                                                                                                        • Opcode ID: 0668517533cd0d68b5080e8717ca13fde84679c12f5f15204a3f6509b4669e23
                                                                                                                                                                                                                                                        • Instruction ID: 6091c37d81cf057244d10fe1457fce88128514ce4b171ec3fb90f57ae6fca4ed
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 0668517533cd0d68b5080e8717ca13fde84679c12f5f15204a3f6509b4669e23
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 80419D32A19642A6EB00DB2295005BD6394FF84788F846533FE0DCBB9FDE3CE9658700
                                                                                                                                                                                                                                                        Function 00007FF6D09EEA08 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 310COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2100369578.00007FF6D09E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D09E0000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100323166.00007FF6D09E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100453442.00007FF6D0A0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A22000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100684836.00007FF6D0A24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff6d09e0000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
                                                                                                                                                                                                                                                        • String ID: csm$csm$csm
                                                                                                                                                                                                                                                        • API String ID: 849930591-393685449
                                                                                                                                                                                                                                                        • Opcode ID: aab7c7e636ea8a2572919ef13f94062ff4905efd63cd4babadd9079b892b9703
                                                                                                                                                                                                                                                        • Instruction ID: 7fa0935ef7fd96ed2e520c11019f7cf75e732627331a2ae481c8b77e65ed6183
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: aab7c7e636ea8a2572919ef13f94062ff4905efd63cd4babadd9079b892b9703
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 6AD17F32A0974196EB209B65D4403AD77A0FB4578CF142136EE8DDBB9BDF38E8A5C740
                                                                                                                                                                                                                                                        Function 00007FF6D09E2C50 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 104windowCOMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        • GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF6D09E3706,?,00007FF6D09E3804), ref: 00007FF6D09E2C9E
                                                                                                                                                                                                                                                        • FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF6D09E3706,?,00007FF6D09E3804), ref: 00007FF6D09E2D63
                                                                                                                                                                                                                                                        • MessageBoxW.USER32 ref: 00007FF6D09E2D99
                                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2100369578.00007FF6D09E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D09E0000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100323166.00007FF6D09E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100453442.00007FF6D0A0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A22000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100684836.00007FF6D0A24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff6d09e0000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: Message$CurrentFormatProcess
                                                                                                                                                                                                                                                        • String ID: %ls: $<FormatMessageW failed.>$Error$[PYI-%d:ERROR]
                                                                                                                                                                                                                                                        • API String ID: 3940978338-251083826
                                                                                                                                                                                                                                                        • Opcode ID: c67c27f58c2af476bbbd059d0433c12e6f67668a4e3ecf6e42cf1bc8669f0b6b
                                                                                                                                                                                                                                                        • Instruction ID: ea6596965dca7444fcfcfdaa2173a0191a02c772ff81d898f15e9c601b7254af
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: c67c27f58c2af476bbbd059d0433c12e6f67668a4e3ecf6e42cf1bc8669f0b6b
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 8231C533708B4162E6249B26A9102AE6695BF88B98F410137EF4DD775EDE3CD956C300
                                                                                                                                                                                                                                                        Function 00007FF6D09EDCC8 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        • LoadLibraryExW.KERNEL32(?,?,?,00007FF6D09EDF7A,?,?,?,00007FF6D09EDC6C,?,?,?,00007FF6D09ED869), ref: 00007FF6D09EDD4D
                                                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,?,?,00007FF6D09EDF7A,?,?,?,00007FF6D09EDC6C,?,?,?,00007FF6D09ED869), ref: 00007FF6D09EDD5B
                                                                                                                                                                                                                                                        • LoadLibraryExW.KERNEL32(?,?,?,00007FF6D09EDF7A,?,?,?,00007FF6D09EDC6C,?,?,?,00007FF6D09ED869), ref: 00007FF6D09EDD85
                                                                                                                                                                                                                                                        • FreeLibrary.KERNEL32(?,?,?,00007FF6D09EDF7A,?,?,?,00007FF6D09EDC6C,?,?,?,00007FF6D09ED869), ref: 00007FF6D09EDDF3
                                                                                                                                                                                                                                                        • GetProcAddress.KERNEL32(?,?,?,00007FF6D09EDF7A,?,?,?,00007FF6D09EDC6C,?,?,?,00007FF6D09ED869), ref: 00007FF6D09EDDFF
                                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2100369578.00007FF6D09E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D09E0000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100323166.00007FF6D09E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100453442.00007FF6D0A0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A22000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100684836.00007FF6D0A24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff6d09e0000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: Library$Load$AddressErrorFreeLastProc
                                                                                                                                                                                                                                                        • String ID: api-ms-
                                                                                                                                                                                                                                                        • API String ID: 2559590344-2084034818
                                                                                                                                                                                                                                                        • Opcode ID: 276526191d17588ee9fa22b972cdf0953455baf5c8a53fb276b347519b5968a9
                                                                                                                                                                                                                                                        • Instruction ID: b7bf6773f2ec1f8ed645f9ae670963ddb35f3c3bea4438a34c998c43714e1be4
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 276526191d17588ee9fa22b972cdf0953455baf5c8a53fb276b347519b5968a9
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 20318521F1B642A1EE159B0698006BD2394FF44BA8F595537DD1DCF7CADF3CE8A48200
                                                                                                                                                                                                                                                        Function 00007FF6D09E6360 Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 82COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2100369578.00007FF6D09E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D09E0000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100323166.00007FF6D09E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100453442.00007FF6D0A0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A22000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100684836.00007FF6D0A24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff6d09e0000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: CurrentProcess
                                                                                                                                                                                                                                                        • String ID: Failed to load Python DLL '%ls'.$LoadLibrary$Path of Python shared library (%s) and its name (%s) exceed buffer size (%d)$Path of ucrtbase.dll (%s) and its name exceed buffer size (%d)$Reported length (%d) of Python shared library name (%s) exceeds buffer size (%d)$ucrtbase.dll
                                                                                                                                                                                                                                                        • API String ID: 2050909247-2434346643
                                                                                                                                                                                                                                                        • Opcode ID: 2df6df0904ecf2e68063807813f252f2c523520ae69ca8fe89000ee1ae80a761
                                                                                                                                                                                                                                                        • Instruction ID: a8dff007917e73dbdc5ece4918793b2b4433f85c2bee3ee8dd48ab968a4dca4e
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 2df6df0904ecf2e68063807813f252f2c523520ae69ca8fe89000ee1ae80a761
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: B5415E22A1D686A1EA15DB21E4152ED6321FB44388F801137DA5CCB7DFEE3CE925C740
                                                                                                                                                                                                                                                        Function 00007FF6D09E2A50 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 64COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        • GetCurrentProcessId.KERNEL32(00000000,?,?,?,00000000,00007FF6D09E351A,?,00000000,00007FF6D09E3F23), ref: 00007FF6D09E2AA0
                                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2100369578.00007FF6D09E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D09E0000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100323166.00007FF6D09E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100453442.00007FF6D0A0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A22000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100684836.00007FF6D0A24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff6d09e0000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: CurrentProcess
                                                                                                                                                                                                                                                        • String ID: 0$WARNING$Warning$Warning [ANSI Fallback]$[PYI-%d:%s]
                                                                                                                                                                                                                                                        • API String ID: 2050909247-2900015858
                                                                                                                                                                                                                                                        • Opcode ID: d3ff72078d09a899d0ca032b5bdbc8691629937d026b54217f09319e947088a3
                                                                                                                                                                                                                                                        • Instruction ID: 8a4296999e819ec093ef64a3a1c21c82667b22c57bebad7c2d181498867ec7d6
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: d3ff72078d09a899d0ca032b5bdbc8691629937d026b54217f09319e947088a3
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: A2219F32A1978162E6209B51B8407EA6394BB88784F441137FE8CC775EDF7CD6658640
                                                                                                                                                                                                                                                        Function 00007FF6D09FB150 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2100369578.00007FF6D09E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D09E0000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100323166.00007FF6D09E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100453442.00007FF6D0A0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A22000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100684836.00007FF6D0A24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff6d09e0000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: Value$ErrorLast
                                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                                        • API String ID: 2506987500-0
                                                                                                                                                                                                                                                        • Opcode ID: a42b9cf7ed1ffe71ebcf97f5a72f2c90d2921d4b6bb9ef7954fc9d2fe8c6feaf
                                                                                                                                                                                                                                                        • Instruction ID: 15fcbea05dcd9f4d7a8612b5dcccbe4772ff1cbbe8b4a1dd11fc4a22a4dd6d21
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: a42b9cf7ed1ffe71ebcf97f5a72f2c90d2921d4b6bb9ef7954fc9d2fe8c6feaf
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 10217F61B0C64271FA589722966517D194A5F447B8F186736FA3ECA7CFDD2CB4604301
                                                                                                                                                                                                                                                        Function 00007FF6D0A07D6C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2100369578.00007FF6D09E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D09E0000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100323166.00007FF6D09E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100453442.00007FF6D0A0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A22000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100684836.00007FF6D0A24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff6d09e0000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
                                                                                                                                                                                                                                                        • String ID: CONOUT$
                                                                                                                                                                                                                                                        • API String ID: 3230265001-3130406586
                                                                                                                                                                                                                                                        • Opcode ID: 3755c2f75cb97972cd4ab37a7e27d28fd0bf6f95a56d27d10542fc75f089f0eb
                                                                                                                                                                                                                                                        • Instruction ID: 3dbc5ef78b77da8940ee4bac26d4f29f9d1125e8e752490e6fc524030deb7bd7
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 3755c2f75cb97972cd4ab37a7e27d28fd0bf6f95a56d27d10542fc75f089f0eb
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 7C119032B2CA4596E7548B13E85432D62A0FB8CBE4F080236EA5DC77ADDF3CD8248740
                                                                                                                                                                                                                                                        Function 00007FF6D09E8ED0 Relevance: 9.1, APIs: 6, Instructions: 121COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        • GetCurrentProcess.KERNEL32(?,FFFFFFFF,00000000,00007FF6D09E3FB1), ref: 00007FF6D09E8EFD
                                                                                                                                                                                                                                                        • K32EnumProcessModules.KERNEL32(?,FFFFFFFF,00000000,00007FF6D09E3FB1), ref: 00007FF6D09E8F5A
                                                                                                                                                                                                                                                          • Part of subcall function 00007FF6D09E9390: MultiByteToWideChar.KERNEL32(?,?,?,00007FF6D09E45F4,00000000,00007FF6D09E1985), ref: 00007FF6D09E93C9
                                                                                                                                                                                                                                                        • K32GetModuleFileNameExW.KERNEL32(?,FFFFFFFF,00000000,00007FF6D09E3FB1), ref: 00007FF6D09E8FE5
                                                                                                                                                                                                                                                        • K32GetModuleFileNameExW.KERNEL32(?,FFFFFFFF,00000000,00007FF6D09E3FB1), ref: 00007FF6D09E9044
                                                                                                                                                                                                                                                        • FreeLibrary.KERNEL32(?,FFFFFFFF,00000000,00007FF6D09E3FB1), ref: 00007FF6D09E9055
                                                                                                                                                                                                                                                        • FreeLibrary.KERNEL32(?,FFFFFFFF,00000000,00007FF6D09E3FB1), ref: 00007FF6D09E906A
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2100369578.00007FF6D09E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D09E0000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100323166.00007FF6D09E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100453442.00007FF6D0A0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A22000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100684836.00007FF6D0A24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff6d09e0000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: FileFreeLibraryModuleNameProcess$ByteCharCurrentEnumModulesMultiWide
                                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                                        • API String ID: 3462794448-0
                                                                                                                                                                                                                                                        • Opcode ID: 0184f5a771bb2c28f933eba3e4018dda16e38d059dd6d010c17659477659ba58
                                                                                                                                                                                                                                                        • Instruction ID: 02127241bff8875a8f4b45c1a5473ae7bdc9df0de9cef3e4c3d5b2daad1abd2f
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 0184f5a771bb2c28f933eba3e4018dda16e38d059dd6d010c17659477659ba58
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 6941F962A1A68191EA309B22A5002BE7394FB84BD9F442136DF9DDB78FDE7CD911C700
                                                                                                                                                                                                                                                        Function 00007FF6D09FB2C8 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,?,?,00007FF6D09F4F11,?,?,?,?,00007FF6D09FA48A,?,?,?,?,00007FF6D09F718F), ref: 00007FF6D09FB2D7
                                                                                                                                                                                                                                                        • FlsSetValue.KERNEL32(?,?,?,00007FF6D09F4F11,?,?,?,?,00007FF6D09FA48A,?,?,?,?,00007FF6D09F718F), ref: 00007FF6D09FB30D
                                                                                                                                                                                                                                                        • FlsSetValue.KERNEL32(?,?,?,00007FF6D09F4F11,?,?,?,?,00007FF6D09FA48A,?,?,?,?,00007FF6D09F718F), ref: 00007FF6D09FB33A
                                                                                                                                                                                                                                                        • FlsSetValue.KERNEL32(?,?,?,00007FF6D09F4F11,?,?,?,?,00007FF6D09FA48A,?,?,?,?,00007FF6D09F718F), ref: 00007FF6D09FB34B
                                                                                                                                                                                                                                                        • FlsSetValue.KERNEL32(?,?,?,00007FF6D09F4F11,?,?,?,?,00007FF6D09FA48A,?,?,?,?,00007FF6D09F718F), ref: 00007FF6D09FB35C
                                                                                                                                                                                                                                                        • SetLastError.KERNEL32(?,?,?,00007FF6D09F4F11,?,?,?,?,00007FF6D09FA48A,?,?,?,?,00007FF6D09F718F), ref: 00007FF6D09FB377
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2100369578.00007FF6D09E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D09E0000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100323166.00007FF6D09E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100453442.00007FF6D0A0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A22000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100684836.00007FF6D0A24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff6d09e0000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: Value$ErrorLast
                                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                                        • API String ID: 2506987500-0
                                                                                                                                                                                                                                                        • Opcode ID: 1c08c83365d44066401784e1b70b71c7670d14ff4fb682678828c33d1612b477
                                                                                                                                                                                                                                                        • Instruction ID: 79f9256ce0655b43d73965ba3e7a0687869c6bd3e959a1b94f87ad5059dc8aef
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 1c08c83365d44066401784e1b70b71c7670d14ff4fb682678828c33d1612b477
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: CB11AE21A4D602B2FA589B22965017D194A9F447B8F186336F93ECB7DFDE6CA4204301
                                                                                                                                                                                                                                                        Function 00007FF6D09E2910 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 86COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        • GetCurrentProcessId.KERNEL32(?,?,?,?,00000000,00000000,?,00000000,00007FF6D09E1B6A), ref: 00007FF6D09E295E
                                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2100369578.00007FF6D09E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D09E0000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100323166.00007FF6D09E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100453442.00007FF6D0A0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A22000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100684836.00007FF6D0A24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff6d09e0000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: CurrentProcess
                                                                                                                                                                                                                                                        • String ID: %s: %s$Error$Error [ANSI Fallback]$[PYI-%d:ERROR]
                                                                                                                                                                                                                                                        • API String ID: 2050909247-2962405886
                                                                                                                                                                                                                                                        • Opcode ID: b3354eec44a94607d33eb4f3788ab89374ba031f66333e1b118589dca889f3f3
                                                                                                                                                                                                                                                        • Instruction ID: 7bcff18e78f6017ab2fe2fb3234da30ccf820198a66694040399eafdfb3cdc71
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: b3354eec44a94607d33eb4f3788ab89374ba031f66333e1b118589dca889f3f3
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 0631F433B1968562E7209761A9402EF6694BF887D8F441133FE8DC774EEF7CE9668200
                                                                                                                                                                                                                                                        Function 00007FF6D09E2390 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 81windowCOMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2100369578.00007FF6D09E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D09E0000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100323166.00007FF6D09E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100453442.00007FF6D0A0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A22000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100684836.00007FF6D0A24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff6d09e0000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: DeleteDestroyDialogHandleIconIndirectModuleObjectParam
                                                                                                                                                                                                                                                        • String ID: Unhandled exception in script
                                                                                                                                                                                                                                                        • API String ID: 3081866767-2699770090
                                                                                                                                                                                                                                                        • Opcode ID: 851ce5d4a208b56cb63585478e484d0f9d6918564d04618497f061aba15d8534
                                                                                                                                                                                                                                                        • Instruction ID: 8376154b6bd52b46599601127c2c6f70c85eccf0d2ef8c4aff60935f81ca09e7
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 851ce5d4a208b56cb63585478e484d0f9d6918564d04618497f061aba15d8534
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: E6318F72619A8299EB24DB21E8552FE6360FF88788F440136FA4D8BB5EDF7CD1118700
                                                                                                                                                                                                                                                        Function 00007FF6D09E2B50 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 65windowCOMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        • GetCurrentProcessId.KERNEL32(?,00000000,00000000,FFFFFFFF,00000000,00007FF6D09E918F,?,00007FF6D09E3C55), ref: 00007FF6D09E2BA0
                                                                                                                                                                                                                                                        • MessageBoxW.USER32 ref: 00007FF6D09E2C2A
                                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2100369578.00007FF6D09E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D09E0000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100323166.00007FF6D09E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100453442.00007FF6D0A0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A22000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100684836.00007FF6D0A24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff6d09e0000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: CurrentMessageProcess
                                                                                                                                                                                                                                                        • String ID: WARNING$Warning$[PYI-%d:%ls]
                                                                                                                                                                                                                                                        • API String ID: 1672936522-3797743490
                                                                                                                                                                                                                                                        • Opcode ID: 4a0b6e8ebe13cae449087f655af1d2523953ec7fd560ce9a50e7097f48d063a1
                                                                                                                                                                                                                                                        • Instruction ID: 43ced5edfa14db7df243e92a3dff2ff2c6430a8a157f625dbfcab8e7a7d16307
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 4a0b6e8ebe13cae449087f655af1d2523953ec7fd560ce9a50e7097f48d063a1
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 6021BC62719B41A2E7209B15B8407EE63A4FB88784F441137EA8D9B75EDF3CE626C740
                                                                                                                                                                                                                                                        Function 00007FF6D09E2710 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 64COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        • GetCurrentProcessId.KERNEL32(?,00000000,00000000,?,00000000,00007FF6D09E1B99), ref: 00007FF6D09E2760
                                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2100369578.00007FF6D09E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D09E0000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100323166.00007FF6D09E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100453442.00007FF6D0A0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A22000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100684836.00007FF6D0A24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff6d09e0000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: CurrentProcess
                                                                                                                                                                                                                                                        • String ID: ERROR$Error$Error [ANSI Fallback]$[PYI-%d:%s]
                                                                                                                                                                                                                                                        • API String ID: 2050909247-1591803126
                                                                                                                                                                                                                                                        • Opcode ID: a4fe537d534c2fb53088f6f6b76b448a80ccad2508d4dc842b27f1a8247accfc
                                                                                                                                                                                                                                                        • Instruction ID: cf4669c6af3e9947633eebd759520dfe2f399eaf443ee449c534e11b0ab4fa35
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: a4fe537d534c2fb53088f6f6b76b448a80ccad2508d4dc842b27f1a8247accfc
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: C9219F72A1978162E620DB51B8407EAA394BB88784F441133FA8CC775EDF7CE5558740
                                                                                                                                                                                                                                                        Function 00007FF6D09F9A88 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2100369578.00007FF6D09E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D09E0000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100323166.00007FF6D09E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100453442.00007FF6D0A0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A22000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100684836.00007FF6D0A24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff6d09e0000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: AddressFreeHandleLibraryModuleProc
                                                                                                                                                                                                                                                        • String ID: CorExitProcess$mscoree.dll
                                                                                                                                                                                                                                                        • API String ID: 4061214504-1276376045
                                                                                                                                                                                                                                                        • Opcode ID: b239dd027a539e56a716c05e535b4da9cb8e2339e08a4dc57142401ef2416000
                                                                                                                                                                                                                                                        • Instruction ID: f0872e34bb8dba97d4f3fdf2f9db042a671e53cb0cbc5a0dcc0794338fc34556
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: b239dd027a539e56a716c05e535b4da9cb8e2339e08a4dc57142401ef2416000
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 5FF0C222B1C70AA1EB188B21E49437E2320EF45764F581237D66E8A7EECF2CD064C300
                                                                                                                                                                                                                                                        Function 00007FF6D0A09368 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2100369578.00007FF6D09E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D09E0000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100323166.00007FF6D09E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100453442.00007FF6D0A0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A22000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100684836.00007FF6D0A24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff6d09e0000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: _set_statfp
                                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                                        • API String ID: 1156100317-0
                                                                                                                                                                                                                                                        • Opcode ID: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
                                                                                                                                                                                                                                                        • Instruction ID: 70dbb5a2c53e880f7de336122c23bc92104d90855399a68364f3f88247270264
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 48116323E5CA0E61F65C1157E4A137D1050AF59370E0C063AFA6E9A3DFCEECA4724501
                                                                                                                                                                                                                                                        Function 00007FF6D09FB390 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        • FlsGetValue.KERNEL32(?,?,?,00007FF6D09FA5A3,?,?,00000000,00007FF6D09FA83E,?,?,?,?,?,00007FF6D09FA7CA), ref: 00007FF6D09FB3AF
                                                                                                                                                                                                                                                        • FlsSetValue.KERNEL32(?,?,?,00007FF6D09FA5A3,?,?,00000000,00007FF6D09FA83E,?,?,?,?,?,00007FF6D09FA7CA), ref: 00007FF6D09FB3CE
                                                                                                                                                                                                                                                        • FlsSetValue.KERNEL32(?,?,?,00007FF6D09FA5A3,?,?,00000000,00007FF6D09FA83E,?,?,?,?,?,00007FF6D09FA7CA), ref: 00007FF6D09FB3F6
                                                                                                                                                                                                                                                        • FlsSetValue.KERNEL32(?,?,?,00007FF6D09FA5A3,?,?,00000000,00007FF6D09FA83E,?,?,?,?,?,00007FF6D09FA7CA), ref: 00007FF6D09FB407
                                                                                                                                                                                                                                                        • FlsSetValue.KERNEL32(?,?,?,00007FF6D09FA5A3,?,?,00000000,00007FF6D09FA83E,?,?,?,?,?,00007FF6D09FA7CA), ref: 00007FF6D09FB418
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2100369578.00007FF6D09E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D09E0000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100323166.00007FF6D09E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100453442.00007FF6D0A0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A22000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100684836.00007FF6D0A24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff6d09e0000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: Value
                                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                                        • API String ID: 3702945584-0
                                                                                                                                                                                                                                                        • Opcode ID: 44f6b3e63c936746b9124b5af5da9c753e88c88086b63197a25bc1506e4861c0
                                                                                                                                                                                                                                                        • Instruction ID: 5a5ef16a25136bf42af45f8d320437d0e8103fbbe850b1530745d3e129650968
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 44f6b3e63c936746b9124b5af5da9c753e88c88086b63197a25bc1506e4861c0
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 72117FA0F0960261FA589B26965117D29495F447B8F4CA336FA3DCEBDFDE2CB8618201
                                                                                                                                                                                                                                                        Function 00007FF6D09FB224 Relevance: 7.6, APIs: 5, Instructions: 50COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2100369578.00007FF6D09E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D09E0000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100323166.00007FF6D09E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100453442.00007FF6D0A0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A22000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100684836.00007FF6D0A24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff6d09e0000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: Value
                                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                                        • API String ID: 3702945584-0
                                                                                                                                                                                                                                                        • Opcode ID: 92671db20a050c4f2636db97a8291f7b9cbb2c044339a59ef12305351f814945
                                                                                                                                                                                                                                                        • Instruction ID: 3963ebe4b975e9383235a0ebb2bb431550efa829053cfd9e1ac6d31604d4631e
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 92671db20a050c4f2636db97a8291f7b9cbb2c044339a59ef12305351f814945
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 551118A0E0860771F958A76244611BD194A5FA533CF18A736FA3ECE7DFDD2CB8604201
                                                                                                                                                                                                                                                        Function 00007FF6D09F5FA0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 242COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2100369578.00007FF6D09E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D09E0000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100323166.00007FF6D09E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100453442.00007FF6D0A0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A22000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100684836.00007FF6D0A24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff6d09e0000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                                        • String ID: verbose
                                                                                                                                                                                                                                                        • API String ID: 3215553584-579935070
                                                                                                                                                                                                                                                        • Opcode ID: 8c3a45f75ca5c0a3459ca2e96ae2fbbf181a3d63a640e770f0a7cf37c7606cec
                                                                                                                                                                                                                                                        • Instruction ID: ef2dcf37f5c8937a5b2822fd73e70f2a6544f1be9fa4216c8be8f2b0c764c579
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 8c3a45f75ca5c0a3459ca2e96ae2fbbf181a3d63a640e770f0a7cf37c7606cec
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 7991B232A0C74691F7618E25D4503BD3AA9AB40B9CF54523BEA5DCB3DBDE3DE8658300
                                                                                                                                                                                                                                                        Function 00007FF6D09FFBC8 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2100369578.00007FF6D09E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D09E0000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100323166.00007FF6D09E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100453442.00007FF6D0A0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A22000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100684836.00007FF6D0A24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff6d09e0000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                                        • String ID: UTF-16LEUNICODE$UTF-8$ccs
                                                                                                                                                                                                                                                        • API String ID: 3215553584-1196891531
                                                                                                                                                                                                                                                        • Opcode ID: 7089664b0a027e884898b454f5d4d61e653d4f3baae8c024cbe23c99275e4c13
                                                                                                                                                                                                                                                        • Instruction ID: 2bea2921b75b775e3f2fd1d963305011231b5df4e7802b8a3261d78f84429480
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 7089664b0a027e884898b454f5d4d61e653d4f3baae8c024cbe23c99275e4c13
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: B8818072D08252A5E7745E2A816027C2EA8AF11B8CF556037EA49DF3DFDF2DE9219301
                                                                                                                                                                                                                                                        Function 00007FF6D09ED648 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 154COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2100369578.00007FF6D09E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D09E0000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100323166.00007FF6D09E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100453442.00007FF6D0A0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A22000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100684836.00007FF6D0A24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff6d09e0000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: CurrentImageNonwritableUnwind__except_validate_context_record
                                                                                                                                                                                                                                                        • String ID: csm
                                                                                                                                                                                                                                                        • API String ID: 2395640692-1018135373
                                                                                                                                                                                                                                                        • Opcode ID: 4bd751ab4a757734da5bac4c310991cbc8ef63d187f18c7a3c34a87046479a0f
                                                                                                                                                                                                                                                        • Instruction ID: d574c5a5451644f72ac83315770e20ed2ecd0ea6891655ffd6e9ab0843e8e930
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 4bd751ab4a757734da5bac4c310991cbc8ef63d187f18c7a3c34a87046479a0f
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: E1516B62E1B602AAEB148B15E444A7C6391FB44B98F149136DA4ECB78ADF7DEC61C700
                                                                                                                                                                                                                                                        Function 00007FF6D09EF288 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2100369578.00007FF6D09E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D09E0000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100323166.00007FF6D09E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100453442.00007FF6D0A0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A22000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100684836.00007FF6D0A24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff6d09e0000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
                                                                                                                                                                                                                                                        • String ID: csm$csm
                                                                                                                                                                                                                                                        • API String ID: 3896166516-3733052814
                                                                                                                                                                                                                                                        • Opcode ID: b828653c103bc27f8420a51a056d9897bfd6e6497fd7c081c32eb92dd3ed2bbb
                                                                                                                                                                                                                                                        • Instruction ID: f037b34b7f8199cd276e4fbaf628226e2005f5c2fc81c1bf56fc648e37350061
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: b828653c103bc27f8420a51a056d9897bfd6e6497fd7c081c32eb92dd3ed2bbb
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: E0517032A09642E6EB648A23906426D7790FB55B88F146137DA5DCBBDEDF3CEC60C701
                                                                                                                                                                                                                                                        Function 00007FF6D09EEED8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2100369578.00007FF6D09E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D09E0000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100323166.00007FF6D09E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100453442.00007FF6D0A0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A22000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100684836.00007FF6D0A24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff6d09e0000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: CallEncodePointerTranslator
                                                                                                                                                                                                                                                        • String ID: MOC$RCC
                                                                                                                                                                                                                                                        • API String ID: 3544855599-2084237596
                                                                                                                                                                                                                                                        • Opcode ID: 1c81a5d02d7979dd4dad50f55436adaf5051385037e661534b2c2f58034018d3
                                                                                                                                                                                                                                                        • Instruction ID: 0e68eafdede0457537b381c373633cb75aecd4ee8f707cd93eb40d06587eb9de
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 1c81a5d02d7979dd4dad50f55436adaf5051385037e661534b2c2f58034018d3
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 9861703290DB85D5EB209B15E4403AEB7A0FB85798F045626EB9C8779EDF7CD5A0CB00
                                                                                                                                                                                                                                                        Function 00007FF6D09E2810 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 65windowCOMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2100369578.00007FF6D09E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D09E0000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100323166.00007FF6D09E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100453442.00007FF6D0A0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A22000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100684836.00007FF6D0A24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff6d09e0000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: Message
                                                                                                                                                                                                                                                        • String ID: ERROR$Error$[PYI-%d:%ls]
                                                                                                                                                                                                                                                        • API String ID: 2030045667-255084403
                                                                                                                                                                                                                                                        • Opcode ID: 035b7a672ed8def45fe49a9c290554376ffedfd07499b26c39d849b73b89d90e
                                                                                                                                                                                                                                                        • Instruction ID: d445ff630d417e8a71fd01fabd1af836d976bb4effb8e4e55036c3e34a108479
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 035b7a672ed8def45fe49a9c290554376ffedfd07499b26c39d849b73b89d90e
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: F021EC72B18B41A2E7208B15B8403EE63A4FB88784F401133EA8D9775EDE3CE666C300
                                                                                                                                                                                                                                                        Function 00007FF6D09FC5A0 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2100369578.00007FF6D09E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D09E0000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100323166.00007FF6D09E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100453442.00007FF6D0A0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A22000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100684836.00007FF6D0A24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff6d09e0000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: FileWrite$ConsoleErrorLastOutput
                                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                                        • API String ID: 2718003287-0
                                                                                                                                                                                                                                                        • Opcode ID: 04e310725d937c0b27e7ac1e6c46040fced781be2c4963351fe3137ba04acc33
                                                                                                                                                                                                                                                        • Instruction ID: 975dec4020716f0e0318b6af3153c8855497d875db011d06fd68e37e5f8b0e28
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 04e310725d937c0b27e7ac1e6c46040fced781be2c4963351fe3137ba04acc33
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 14D102B2B18A8199E710CF65C5402AC3BB5FB5479CB149236EE5DDBB8ADE38D467C300
                                                                                                                                                                                                                                                        Function 00007FF6D09E20C0 Relevance: 6.1, APIs: 4, Instructions: 52COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2100369578.00007FF6D09E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D09E0000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100323166.00007FF6D09E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100453442.00007FF6D0A0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A22000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100684836.00007FF6D0A24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff6d09e0000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: LongWindow$DialogInvalidateRect
                                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                                        • API String ID: 1956198572-0
                                                                                                                                                                                                                                                        • Opcode ID: 3f66ec3ad31a24d6b03c6ecd933265a99c2c3f38e7b83c206d3886b5f9d1bb92
                                                                                                                                                                                                                                                        • Instruction ID: 034b76fa4c155da30588fa5257f26a18e3a59c50ad111b78117c8b2c3f3ba714
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 3f66ec3ad31a24d6b03c6ecd933265a99c2c3f38e7b83c206d3886b5f9d1bb92
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: E211A921E1C14692F654976AE5442BD5251FB84784F585033DB49CBB9FCD2DDAA58200
                                                                                                                                                                                                                                                        Function 00007FF6D0A05B1C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2100369578.00007FF6D09E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D09E0000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100323166.00007FF6D09E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100453442.00007FF6D0A0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A22000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100684836.00007FF6D0A24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff6d09e0000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: _get_daylight$_invalid_parameter_noinfo
                                                                                                                                                                                                                                                        • String ID: ?
                                                                                                                                                                                                                                                        • API String ID: 1286766494-1684325040
                                                                                                                                                                                                                                                        • Opcode ID: 21862b7f5a6063227688de7d7fc5fbfc7fa1fb1d7946118fe9e576ba790fa6aa
                                                                                                                                                                                                                                                        • Instruction ID: 6e7449029d034ddc019011165d01aaeceba8ada4a395aeb6b7b05460717e7937
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 21862b7f5a6063227688de7d7fc5fbfc7fa1fb1d7946118fe9e576ba790fa6aa
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: B241D823A1C38A66F7689737944137E6654EB81BA4F184236EE5C86BDEDE3CE4618700
                                                                                                                                                                                                                                                        Function 00007FF6D09F9014 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        • _invalid_parameter_noinfo.LIBCMT ref: 00007FF6D09F9046
                                                                                                                                                                                                                                                          • Part of subcall function 00007FF6D09FA948: RtlFreeHeap.NTDLL(?,?,?,00007FF6D0A02D22,?,?,?,00007FF6D0A02D5F,?,?,00000000,00007FF6D0A03225,?,?,?,00007FF6D0A03157), ref: 00007FF6D09FA95E
                                                                                                                                                                                                                                                          • Part of subcall function 00007FF6D09FA948: GetLastError.KERNEL32(?,?,?,00007FF6D0A02D22,?,?,?,00007FF6D0A02D5F,?,?,00000000,00007FF6D0A03225,?,?,?,00007FF6D0A03157), ref: 00007FF6D09FA968
                                                                                                                                                                                                                                                        • GetModuleFileNameW.KERNEL32(?,?,?,?,?,00007FF6D09ECBA5), ref: 00007FF6D09F9064
                                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2100369578.00007FF6D09E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D09E0000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100323166.00007FF6D09E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100453442.00007FF6D0A0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A22000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100684836.00007FF6D0A24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff6d09e0000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: ErrorFileFreeHeapLastModuleName_invalid_parameter_noinfo
                                                                                                                                                                                                                                                        • String ID: C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                        • API String ID: 3580290477-590426878
                                                                                                                                                                                                                                                        • Opcode ID: 136b352ca89953b7aac46d199a587659114d0cf60bae53edf27061cb20026a80
                                                                                                                                                                                                                                                        • Instruction ID: 1bd7f629281579f9cc912acfa36cec65210be1d6ca3e3485ffbd75f14c835963
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 136b352ca89953b7aac46d199a587659114d0cf60bae53edf27061cb20026a80
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 8B417132A0CA02A5EB159F2594400BD6B98EB457D8B596037FD4D8BB9ADE7CE4A18300
                                                                                                                                                                                                                                                        Function 00007FF6D09FCC38 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2100369578.00007FF6D09E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D09E0000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100323166.00007FF6D09E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100453442.00007FF6D0A0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A22000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100684836.00007FF6D0A24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff6d09e0000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: ErrorFileLastWrite
                                                                                                                                                                                                                                                        • String ID: U
                                                                                                                                                                                                                                                        • API String ID: 442123175-4171548499
                                                                                                                                                                                                                                                        • Opcode ID: 4f5d94246872f2193e537bc66f33c90add5f7e97f4787e66017fcfb3b1ebd6d4
                                                                                                                                                                                                                                                        • Instruction ID: d2a5e62d5ee55c6b8be9ea0e7dba3dfd8985deae8e724121ef1a195a6d4380d4
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 4f5d94246872f2193e537bc66f33c90add5f7e97f4787e66017fcfb3b1ebd6d4
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: EA41B362A18A4591DB20CF25E4443AE6BA4FB88788F449136EE8DC7799DF3CD412C740
                                                                                                                                                                                                                                                        Function 00007FF6D09FF5B8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2100369578.00007FF6D09E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D09E0000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100323166.00007FF6D09E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100453442.00007FF6D0A0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A22000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100684836.00007FF6D0A24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff6d09e0000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: CurrentDirectory
                                                                                                                                                                                                                                                        • String ID: :
                                                                                                                                                                                                                                                        • API String ID: 1611563598-336475711
                                                                                                                                                                                                                                                        • Opcode ID: 9aa1b1c0966d0181e71a7442aa19fd9d8a3a06258be719e39fc35e3b215e25b0
                                                                                                                                                                                                                                                        • Instruction ID: d7a1a42d17a2deb127ee479aa456f20680e5d8a61eaa8a8419235bff7d27aa74
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 9aa1b1c0966d0181e71a7442aa19fd9d8a3a06258be719e39fc35e3b215e25b0
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: E9212562A0824591EB208B12D05426D37A5FF88B48F858036EA8CCB78ECF7CE964C740
                                                                                                                                                                                                                                                        Function 00007FF6D09EFD48 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2100369578.00007FF6D09E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D09E0000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100323166.00007FF6D09E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100453442.00007FF6D0A0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A22000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100684836.00007FF6D0A24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff6d09e0000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: ExceptionFileHeaderRaise
                                                                                                                                                                                                                                                        • String ID: csm
                                                                                                                                                                                                                                                        • API String ID: 2573137834-1018135373
                                                                                                                                                                                                                                                        • Opcode ID: b596af9f6a60738c50b353da5cbad86497326ffe12a5eabfdc94c01c9dae4a3e
                                                                                                                                                                                                                                                        • Instruction ID: 13a41ce7a4095354807cab8f1bc5f3075c9567ff969f47be065488bb92688e14
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: b596af9f6a60738c50b353da5cbad86497326ffe12a5eabfdc94c01c9dae4a3e
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 03115132619B8592DB118F16E40025D77E4FB88B88F184232DB8D8B75DDF3CC9618B00
                                                                                                                                                                                                                                                        Function 00007FF6D0A0073C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2100369578.00007FF6D09E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D09E0000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100323166.00007FF6D09E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100453442.00007FF6D0A0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100604334.00007FF6D0A22000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2100684836.00007FF6D0A24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff6d09e0000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: DriveType_invalid_parameter_noinfo
                                                                                                                                                                                                                                                        • String ID: :
                                                                                                                                                                                                                                                        • API String ID: 2595371189-336475711
                                                                                                                                                                                                                                                        • Opcode ID: 68237dfdc7112287ec82a3b365f776b5c9f6f856de5878160eaa1a8f91e0357f
                                                                                                                                                                                                                                                        • Instruction ID: 196d6eda9cfea82efff299ff2e8e523d7f97fa97f82248046108580a104b3fb5
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 68237dfdc7112287ec82a3b365f776b5c9f6f856de5878160eaa1a8f91e0357f
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 14018F6291C607A6F724AF61946167E27A0EF88748F881037E64DC678EDF2CE5258B14

                                                                                                                                                                                                                                                        Execution Graph

                                                                                                                                                                                                                                                        Execution Coverage:22.1%
                                                                                                                                                                                                                                                        Dynamic/Decrypted Code Coverage:0%
                                                                                                                                                                                                                                                        Signature Coverage:0%
                                                                                                                                                                                                                                                        Total number of Nodes:416
                                                                                                                                                                                                                                                        Total number of Limit Nodes:13
                                                                                                                                                                                                                                                        execution_graph 3737 7ff6d09f4984 3739 7ff6d09f49de 3737->3739 3738 7ff6d09f4ae8 3745 7ff6d09f4b1c 3738->3745 3747 7ff6d09f4af1 3738->3747 3739->3738 3741 7ff6d09f4a03 3739->3741 3742 7ff6d09f4b40 3739->3742 3739->3745 3739->3747 3740 7ff6d09fa948 _fread_nolock 2 API calls 3740->3741 3743 7ff6d09f4b4a 3742->3743 3742->3745 3746 7ff6d09fa948 _fread_nolock 2 API calls 3743->3746 3744 7ff6d09fa948 _fread_nolock 2 API calls 3744->3741 3745->3740 3746->3741 3747->3744 3704 7ff6d09fb224 3705 7ff6d09fb235 FlsGetValue 3704->3705 3706 7ff6d09fb250 FlsSetValue 3704->3706 3707 7ff6d09fb24a 3705->3707 3709 7ff6d09fb242 3705->3709 3708 7ff6d09fb25d 3706->3708 3706->3709 3707->3706 3710 7ff6d09fb28a FlsSetValue 3708->3710 3711 7ff6d09fb27a FlsSetValue 3708->3711 3713 7ff6d09fb2a8 3710->3713 3714 7ff6d09fb296 FlsSetValue 3710->3714 3712 7ff6d09fb283 3711->3712 3715 7ff6d09fa948 _fread_nolock 2 API calls 3712->3715 3716 7ff6d09fa948 _fread_nolock 2 API calls 3713->3716 3714->3712 3715->3709 3716->3709 3329 7ff6d09ebae0 3330 7ff6d09ebb0e 3329->3330 3331 7ff6d09ebaf5 3329->3331 3331->3330 3334 7ff6d09fd5fc 3331->3334 3332 7ff6d09ebb6e 3336 7ff6d09fd645 3334->3336 3337 7ff6d09fd60b 3334->3337 3335 7ff6d09fd62e HeapAlloc 3335->3336 3335->3337 3336->3332 3337->3335 3337->3336 3642 7ff6d09f5160 3643 7ff6d09f5177 3642->3643 3644 7ff6d09fa948 _fread_nolock 2 API calls 3643->3644 3645 7ff6d09f517f 3643->3645 3644->3645 3646 7ff6d09f9961 3647 7ff6d09f9966 3646->3647 3648 7ff6d09f998d GetModuleHandleW 3647->3648 3649 7ff6d09f999a 3647->3649 3648->3649 3650 7ff6d09f9a1a 3649->3650 3653 7ff6d09f9a30 3649->3653 3654 7ff6d09f9a3d 3653->3654 3655 7ff6d09f9a52 3654->3655 3656 7ff6d09f9a41 GetCurrentProcess TerminateProcess 3654->3656 3657 7ff6d09f9a59 ExitProcess 3655->3657 3656->3655 3338 7ff6d09fc1e0 3339 7ff6d09fc210 3338->3339 3342 7ff6d09fc014 3339->3342 3341 7ff6d09fc229 3343 7ff6d09fc06b 3342->3343 3345 7ff6d09fc03d 3342->3345 3343->3345 3346 7ff6d09fc134 3343->3346 3345->3341 3347 7ff6d09fc15b 3346->3347 3348 7ff6d09fc172 SetFilePointerEx 3347->3348 3350 7ff6d09fc161 3347->3350 3349 7ff6d09fc18a GetLastError 3348->3349 3348->3350 3349->3350 3350->3345 3670 7ffdfa028194 3671 7ffdfa0281b0 3670->3671 3672 7ffdfa0281b5 3670->3672 3674 7ffdfa0284f0 3671->3674 3675 7ffdfa028513 GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter 3674->3675 3676 7ffdfa028587 3674->3676 3675->3676 3676->3672 3351 7ff6d09e2fe0 3353 7ff6d09e2ff0 3351->3353 3354 7ff6d09e302b 3353->3354 3355 7ff6d09e1470 3353->3355 3366 7ff6d09e45c0 3355->3366 3357 7ff6d09e149b 3357->3353 3358 7ff6d09e1493 3358->3357 3359 7ff6d09e1538 3358->3359 3362 7ff6d09e154b 3358->3362 3365 7ff6d09e14d5 3358->3365 3370 7ff6d09e1210 3359->3370 3362->3365 3378 7ff6d09f039c 3362->3378 3363 7ff6d09e15c4 3363->3353 3374 7ff6d09f004c 3365->3374 3367 7ff6d09e45cc 3366->3367 3381 7ff6d09f5f94 3367->3381 3369 7ff6d09e4616 3369->3358 3373 7ff6d09e1268 3370->3373 3371 7ff6d09f039c _fread_nolock 15 API calls 3371->3373 3372 7ff6d09e126f 3372->3365 3373->3371 3373->3372 3375 7ff6d09f007c 3374->3375 3417 7ff6d09efe28 3375->3417 3377 7ff6d09f0095 3377->3363 3444 7ff6d09f03bc 3378->3444 3380 7ff6d09f03b4 3380->3362 3382 7ff6d09f5ec8 3381->3382 3383 7ff6d09f5eee 3382->3383 3385 7ff6d09f5f21 3382->3385 3384 7ff6d09f5ef3 _invalid_parameter_noinfo 3383->3384 3387 7ff6d09f5efe 3384->3387 3385->3387 3388 7ff6d09ffecc 3385->3388 3387->3369 3389 7ff6d09ffef2 3388->3389 3390 7ff6d09fff26 3389->3390 3392 7ff6d0a06d54 3389->3392 3390->3387 3395 7ff6d0a06354 3392->3395 3394 7ff6d0a06d81 3394->3390 3396 7ff6d0a0636b 3395->3396 3397 7ff6d0a06389 3395->3397 3398 7ff6d0a06370 _invalid_parameter_noinfo 3396->3398 3397->3396 3399 7ff6d0a063a5 3397->3399 3401 7ff6d0a0637e 3398->3401 3402 7ff6d0a06964 3399->3402 3401->3394 3403 7ff6d0a069ab 3402->3403 3404 7ff6d0a06a16 CreateFileW 3403->3404 3405 7ff6d0a069d9 3403->3405 3406 7ff6d0a06a81 3404->3406 3407 7ff6d0a06afc GetFileType 3404->3407 3405->3401 3409 7ff6d0a06ac9 GetLastError 3406->3409 3411 7ff6d0a06a8f CreateFileW 3406->3411 3408 7ff6d0a06b09 GetLastError 3407->3408 3413 7ff6d0a06b5a 3407->3413 3410 7ff6d09f4e7c 3408->3410 3409->3405 3412 7ff6d0a06b18 CloseHandle 3410->3412 3411->3407 3411->3409 3412->3405 3416 7ff6d0a06b4a 3412->3416 3413->3405 3414 7ff6d0a06c9c CloseHandle CreateFileW 3413->3414 3415 7ff6d0a06ce3 GetLastError 3414->3415 3414->3416 3415->3416 3416->3405 3418 7ff6d09efe71 3417->3418 3420 7ff6d09efe43 3417->3420 3418->3420 3421 7ff6d09efea4 3418->3421 3420->3377 3422 7ff6d09efee4 3421->3422 3423 7ff6d09efebf 3421->3423 3422->3423 3427 7ff6d09fa9fc 3422->3427 3423->3420 3425 7ff6d09eff13 3425->3423 3431 7ff6d09fa948 3425->3431 3428 7ff6d09faa10 3427->3428 3429 7ff6d09faa28 3427->3429 3428->3425 3429->3428 3435 7ff6d09fa984 3429->3435 3432 7ff6d09fa94d HeapFree 3431->3432 3434 7ff6d09fa975 3431->3434 3433 7ff6d09fa968 GetLastError 3432->3433 3432->3434 3433->3434 3434->3423 3436 7ff6d09fa9a0 3435->3436 3437 7ff6d09fa9d5 3436->3437 3439 7ff6d09fab58 3436->3439 3437->3428 3443 7ff6d09fab74 3439->3443 3440 7ff6d09fabc3 CloseHandle 3441 7ff6d09fabd0 GetLastError 3440->3441 3442 7ff6d09fab7a 3440->3442 3441->3442 3442->3437 3443->3440 3443->3442 3445 7ff6d09f03e6 3444->3445 3450 7ff6d09f0415 3444->3450 3446 7ff6d09f03f5 3445->3446 3447 7ff6d09f0432 3445->3447 3445->3450 3448 7ff6d09f040a _invalid_parameter_noinfo 3446->3448 3451 7ff6d09f013c 3447->3451 3448->3450 3450->3380 3453 7ff6d09f016b 3451->3453 3458 7ff6d09f0185 3451->3458 3452 7ff6d09f0175 3454 7ff6d09f0180 _invalid_parameter_noinfo 3452->3454 3453->3452 3457 7ff6d09f0271 _invalid_parameter_noinfo 3453->3457 3453->3458 3459 7ff6d09fba5c 3453->3459 3485 7ff6d09fbeac 3453->3485 3454->3458 3457->3453 3458->3450 3460 7ff6d09fba9d 3459->3460 3461 7ff6d09fba84 3459->3461 3460->3461 3463 7ff6d09fbaf1 3460->3463 3464 7ff6d09fbb22 3460->3464 3461->3453 3462 7ff6d09fbe89 _invalid_parameter_noinfo 3462->3461 3463->3462 3465 7ff6d09fbb49 3464->3465 3466 7ff6d09fbb83 3464->3466 3470 7ff6d09fbb56 3464->3470 3465->3470 3475 7ff6d09fbb72 3465->3475 3467 7ff6d09fd5fc _fread_nolock HeapAlloc 3466->3467 3468 7ff6d09fbb94 3467->3468 3469 7ff6d09fa948 _fread_nolock 2 API calls 3468->3469 3471 7ff6d09fbb9e 3469->3471 3472 7ff6d09fbb62 _invalid_parameter_noinfo 3470->3472 3473 7ff6d09fa948 _fread_nolock 2 API calls 3471->3473 3484 7ff6d09fbbad 3472->3484 3473->3475 3474 7ff6d09fbd1e 3476 7ff6d09fbd23 ReadFile 3474->3476 3475->3474 3477 7ff6d09fbcb1 GetConsoleMode 3475->3477 3475->3484 3479 7ff6d09fbe3d GetLastError 3476->3479 3480 7ff6d09fbd49 3476->3480 3477->3474 3481 7ff6d09fbcc5 3477->3481 3478 7ff6d09fa948 _fread_nolock 2 API calls 3478->3461 3479->3484 3480->3479 3480->3484 3481->3476 3482 7ff6d09fbccf ReadConsoleW 3481->3482 3483 7ff6d09fbcf3 GetLastError 3482->3483 3482->3484 3483->3484 3484->3478 3486 7ff6d09fbec9 3485->3486 3488 7ff6d09fbef4 3485->3488 3487 7ff6d09fbece _invalid_parameter_noinfo 3486->3487 3492 7ff6d09fbed9 3487->3492 3489 7ff6d09fbf30 3488->3489 3488->3492 3500 7ff6d0a0397c 3488->3500 3493 7ff6d09fb93c 3489->3493 3492->3453 3494 7ff6d09fb996 3493->3494 3499 7ff6d09fb966 3493->3499 3495 7ff6d09fba0b 3494->3495 3498 7ff6d09fb9af 3494->3498 3497 7ff6d09fba5c _fread_nolock 10 API calls 3495->3497 3495->3499 3496 7ff6d09fb9c2 _invalid_parameter_noinfo 3496->3499 3497->3499 3498->3496 3499->3492 3501 7ff6d0a039a0 3500->3501 3502 7ff6d09fa948 _fread_nolock 2 API calls 3501->3502 3503 7ff6d0a039ab 3502->3503 3503->3489 3748 7ff6d09e2180 GetDC 3749 7ff6d09e224d 3748->3749 3750 7ff6d09e21bd 3748->3750 3751 7ff6d09e2252 MoveWindow MoveWindow MoveWindow MoveWindow 3749->3751 3752 7ff6d09e21ef SelectObject 3750->3752 3753 7ff6d09e21fb DrawTextW 3750->3753 3754 7ff6d09e2379 3751->3754 3752->3753 3755 7ff6d09e2225 SelectObject 3753->3755 3756 7ff6d09e2231 ReleaseDC 3753->3756 3755->3756 3756->3751 3504 7ff6d09ecc3c 3505 7ff6d09ecc50 3504->3505 3506 7ff6d09ecc58 __scrt_acquire_startup_lock 3505->3506 3507 7ff6d09ecc9b 3505->3507 3506->3507 3508 7ff6d09ecc76 3506->3508 3508->3507 3509 7ff6d09ecccc __scrt_release_startup_lock 3508->3509 3513 7ff6d09eccd8 3509->3513 3510 7ff6d09ecd21 __scrt_get_show_window_mode 3511 7ff6d09ecd2e 3510->3511 3514 7ff6d09e1000 3511->3514 3513->3510 3515 7ff6d09e1009 3514->3515 3547 7ff6d09e36b0 3515->3547 3517 7ff6d09e3804 3520 7ff6d09e3808 3517->3520 3554 7ff6d09e1950 3517->3554 3519 7ff6d09e3825 3521 7ff6d09e45c0 11 API calls 3519->3521 3529 7ff6d09e383c 3519->3529 3520->3507 3522 7ff6d09e392b 3521->3522 3522->3520 3570 7ff6d09e7f90 3522->3570 3524 7ff6d09e395d 3525 7ff6d09e3962 3524->3525 3527 7ff6d09e3984 3524->3527 3526 7ff6d09f004c 4 API calls 3525->3526 3526->3520 3528 7ff6d09e1950 28 API calls 3527->3528 3528->3529 3529->3520 3530 7ff6d09e3da7 SetDllDirectoryW LoadLibraryExW 3529->3530 3531 7ff6d09e3dc4 3529->3531 3530->3531 3532 7ff6d09e3de8 SetDllDirectoryW 3531->3532 3543 7ff6d09e3e0a 3532->3543 3545 7ff6d09e3e5a 3532->3545 3533 7ff6d09e4008 3535 7ff6d09e4012 PostMessageW GetMessageW 3533->3535 3536 7ff6d09e4035 3533->3536 3534 7ff6d09e3f1b 3534->3520 3537 7ff6d09e3f2b 3534->3537 3535->3536 3565 7ff6d09e3360 3536->3565 3539 7ff6d09e3f64 3537->3539 3540 7ff6d09e3f41 PostMessageW GetMessageW 3537->3540 3579 7ff6d09e89e0 3539->3579 3540->3539 3542 7ff6d09e4045 3543->3545 3574 7ff6d09e71b0 3543->3574 3545->3533 3545->3534 3546 7ff6d09e3f7f 3546->3520 3548 7ff6d09ec850 3547->3548 3549 7ff6d09e36bc GetModuleFileNameW 3548->3549 3550 7ff6d09e3710 3549->3550 3551 7ff6d09e36eb GetLastError 3549->3551 3614 7ff6d09e9280 FindFirstFileExW 3550->3614 3553 7ff6d09e3706 3551->3553 3553->3517 3555 7ff6d09e45c0 11 API calls 3554->3555 3556 7ff6d09e1985 3555->3556 3557 7ff6d09e1c43 3556->3557 3558 7ff6d09e7f90 15 API calls 3556->3558 3557->3519 3560 7ff6d09e19cb 3558->3560 3559 7ff6d09f004c 4 API calls 3559->3557 3561 7ff6d09f039c _fread_nolock 15 API calls 3560->3561 3564 7ff6d09e19e9 3560->3564 3562 7ff6d09e1a20 3561->3562 3563 7ff6d09f039c _fread_nolock 15 API calls 3562->3563 3562->3564 3563->3564 3564->3559 3617 7ff6d09e6360 3565->3617 3567 7ff6d09e338d 3567->3542 3568 7ff6d09e336e 3568->3567 3625 7ff6d09e6050 3568->3625 3571 7ff6d09e7fb4 3570->3571 3572 7ff6d09e808b 3571->3572 3573 7ff6d09f039c _fread_nolock 15 API calls 3571->3573 3572->3524 3573->3571 3575 7ff6d09e8e80 LoadLibraryExW 3574->3575 3576 7ff6d09e71c9 3575->3576 3577 7ff6d09e8e80 LoadLibraryExW 3576->3577 3578 7ff6d09e71dc 3577->3578 3578->3545 3580 7ff6d09e8a00 3579->3580 3581 7ff6d09e8a2d SetConsoleCtrlHandler GetStartupInfoW 3580->3581 3582 7ff6d09e8a7a 3581->3582 3583 7ff6d09e8ad0 GetCommandLineW CreateProcessW 3582->3583 3584 7ff6d09e8b4d RegisterClassW 3583->3584 3585 7ff6d09e8b28 GetLastError 3583->3585 3586 7ff6d09e8b91 CreateWindowExW 3584->3586 3587 7ff6d09e8b8b GetLastError 3584->3587 3591 7ff6d09e8b43 3585->3591 3588 7ff6d09e8bef ShowWindow 3586->3588 3589 7ff6d09e8be7 GetLastError 3586->3589 3587->3586 3590 7ff6d09e8bfa WaitForSingleObject 3588->3590 3589->3590 3592 7ff6d09e8c0c 3590->3592 3593 7ff6d09e8c88 3590->3593 3591->3546 3595 7ff6d09e8c91 WaitForSingleObject 3592->3595 3600 7ff6d09e8c15 GetLastError 3592->3600 3606 7ff6d09e8c24 PeekMessageW 3592->3606 3594 7ff6d09e8cd2 3593->3594 3593->3595 3598 7ff6d09e8dc0 GetMessageW 3594->3598 3599 7ff6d09e8cdf QueryPerformanceFrequency QueryPerformanceCounter 3594->3599 3596 7ff6d09e8df8 3595->3596 3597 7ff6d09e8ca7 TerminateProcess 3595->3597 3601 7ff6d09e8e04 DestroyWindow 3596->3601 3602 7ff6d09e8e11 GetExitCodeProcess CloseHandle CloseHandle 3596->3602 3603 7ff6d09e8cbf WaitForSingleObject 3597->3603 3604 7ff6d09e8cb9 GetLastError 3597->3604 3607 7ff6d09e8ddb TranslateMessage DispatchMessageW 3598->3607 3613 7ff6d09e8dab 3598->3613 3605 7ff6d09e8d00 MsgWaitForMultipleObjects PeekMessageW 3599->3605 3600->3592 3601->3602 3602->3591 3603->3596 3604->3603 3608 7ff6d09e8d3a 3605->3608 3609 7ff6d09e8c43 TranslateMessage DispatchMessageW PeekMessageW 3606->3609 3610 7ff6d09e8c76 WaitForSingleObject 3606->3610 3607->3613 3608->3598 3611 7ff6d09e8d40 TranslateMessage DispatchMessageW PeekMessageW 3608->3611 3612 7ff6d09e8d7c QueryPerformanceCounter 3608->3612 3609->3609 3609->3610 3610->3592 3610->3593 3611->3608 3611->3611 3612->3605 3612->3613 3613->3596 3613->3598 3615 7ff6d09e92bf FindClose 3614->3615 3616 7ff6d09e92d2 3614->3616 3615->3616 3616->3553 3618 7ff6d09e6375 3617->3618 3619 7ff6d09e8e80 LoadLibraryExW 3618->3619 3620 7ff6d09e642b 3618->3620 3621 7ff6d09e63ba 3618->3621 3619->3620 3620->3621 3629 7ff6d09e8e80 3620->3629 3621->3568 3623 7ff6d09e6476 3623->3621 3624 7ff6d09e649a GetLastError 3623->3624 3624->3621 3628 7ff6d09e6070 3625->3628 3626 7ff6d09e6099 3626->3567 3627 7ff6d09e1470 28 API calls 3627->3628 3628->3626 3628->3627 3630 7ff6d09e9390 3629->3630 3631 7ff6d09e8e94 LoadLibraryExW 3630->3631 3632 7ff6d09e8eb3 3631->3632 3632->3623 3757 7ff6d0a031fc 3758 7ff6d0a0322d 3757->3758 3759 7ff6d0a03201 3757->3759 3759->3758 3760 7ff6d09fa948 _fread_nolock 2 API calls 3759->3760 3760->3758 3717 7ff6d09fca18 3720 7ff6d09fca30 3717->3720 3718 7ff6d09fcae5 3719 7ff6d09fcaae WriteFile 3719->3720 3721 7ff6d09fcae7 GetLastError 3719->3721 3720->3718 3720->3719 3721->3718 3722 7ff6d09f9198 3723 7ff6d09f91b1 3722->3723 3730 7ff6d09f91ad 3722->3730 3724 7ff6d09f91c3 3723->3724 3726 7ff6d09f91cf 3723->3726 3725 7ff6d09fa948 _fread_nolock 2 API calls 3724->3725 3725->3730 3727 7ff6d09fa948 _fread_nolock 2 API calls 3726->3727 3728 7ff6d09f91f6 3727->3728 3729 7ff6d09fa948 _fread_nolock 2 API calls 3728->3729 3729->3730 3658 7ff6d0a08974 3659 7ff6d0a089a5 3658->3659 3660 7ff6d0a08a6d 3659->3660 3661 7ff6d0a08a6f 3659->3661 3663 7ff6d0a089db 3659->3663 3661->3660 3664 7ff6d0a08a98 SetEndOfFile 3661->3664 3662 7ff6d09fa948 _fread_nolock 2 API calls 3662->3660 3663->3662 3664->3660 3665 7ff6d0a08aa5 GetLastError 3664->3665 3665->3660 3731 7ff6d09ec9b4 3734 7ff6d09ec9c8 IsProcessorFeaturePresent 3731->3734 3733 7ff6d09ec9c2 3735 7ff6d09ec9df 3734->3735 3736 7ff6d09ec9e7 capture_current_context __raise_securityfailure 3734->3736 3735->3736 3736->3733 3677 7ff6d09e81d0 3678 7ff6d09e81dc 3677->3678 3679 7ff6d09e8216 ExpandEnvironmentStringsW 3678->3679 3688 7ff6d09e8203 3678->3688 3680 7ff6d09e823c 3679->3680 3681 7ff6d09e8261 GetDriveTypeW 3680->3681 3683 7ff6d09e82bf 3680->3683 3680->3688 3681->3688 3684 7ff6d09e834e CreateDirectoryW 3683->3684 3687 7ff6d09e8328 CreateDirectoryW 3683->3687 3683->3688 3685 7ff6d09e835d GetLastError 3684->3685 3684->3688 3686 7ff6d09e836a GetLastError 3685->3686 3685->3688 3686->3688 3687->3683 3689 7ff6d09fb150 GetLastError 3690 7ff6d09fb174 FlsGetValue 3689->3690 3691 7ff6d09fb191 FlsSetValue 3689->3691 3692 7ff6d09fb181 3690->3692 3693 7ff6d09fb18b 3690->3693 3691->3692 3696 7ff6d09fb1a3 3691->3696 3694 7ff6d09fb1fd SetLastError 3692->3694 3693->3691 3695 7ff6d09fb20a 3694->3695 3697 7ff6d09fb1d0 FlsSetValue 3696->3697 3698 7ff6d09fb1c0 FlsSetValue 3696->3698 3699 7ff6d09fb1ee 3697->3699 3700 7ff6d09fb1dc FlsSetValue 3697->3700 3701 7ff6d09fb1c9 3698->3701 3703 7ff6d09fa948 _fread_nolock 2 API calls 3699->3703 3700->3701 3702 7ff6d09fa948 _fread_nolock 2 API calls 3701->3702 3702->3692 3703->3694 3761 7ff6d09e4190 3763 7ff6d09e41a1 3761->3763 3762 7ff6d09e1950 28 API calls 3764 7ff6d09e4267 3762->3764 3763->3762 3763->3764 3666 7ff6d0a0116c 3668 7ff6d0a011a0 3666->3668 3667 7ff6d0a01214 3668->3667 3669 7ff6d0a01204 _invalid_parameter_noinfo 3668->3669 3669->3667 3774 7ff6d09ff98c 3775 7ff6d09ff9ce 3774->3775 3777 7ff6d09ffaab _isindst 3774->3777 3776 7ff6d09ffa6c _get_daylight 3775->3776 3775->3777 3776->3777 3778 7ff6d09ffa89 _get_daylight 3776->3778 3778->3777 3779 7ff6d09ffa9a _get_daylight 3778->3779 3779->3777 3633 7ff6d09f5628 3634 7ff6d09f565f 3633->3634 3637 7ff6d09f5642 3633->3637 3635 7ff6d09f5672 CreateFileW 3634->3635 3634->3637 3636 7ff6d09f56a6 3635->3636 3641 7ff6d09f56dc 3635->3641 3639 7ff6d09f56d1 CloseHandle 3636->3639 3640 7ff6d09f56bb CloseHandle 3636->3640 3638 7ff6d09f564f _invalid_parameter_noinfo 3637->3638 3638->3641 3639->3641 3640->3641 3780 7ff6d09eea08 3789 7ff6d09ef9bc 3780->3789 3782 7ff6d09eed85 __FrameHandler3::ExecutionInCatch 3786 7ff6d09eed98 3782->3786 3783 7ff6d09eea6a 3784 7ff6d09eeb4f 3783->3784 3785 7ff6d09eeb3a Is_bad_exception_allowed 3783->3785 3783->3786 3784->3782 3784->3786 3785->3786 3787 7ff6d09eeb4a 3785->3787 3788 7ff6d09eee94 std::bad_alloc::bad_alloc 3787->3788 3788->3786 3790 7ff6d09ef9e1 3789->3790 3791 7ff6d09ef9f6 __GetUnwindTryBlock 3790->3791 3792 7ff6d09efa2b __GetUnwindTryBlock 3791->3792 3793 7ff6d09efa08 3791->3793 3794 7ff6d09efa3b 3792->3794 3795 7ff6d09efa18 __SetUnwindTryBlock 3793->3795 3794->3783 3795->3794

                                                                                                                                                                                                                                                        Executed Functions

                                                                                                                                                                                                                                                        Function 00007FF6D09E1000 Relevance: 61.8, APIs: 7, Strings: 28, Instructions: 511COMMON
                                                                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                                                                        control_flow_graph 0 7ff6d09e1000-7ff6d09e3806 call 7ff6d09efe18 call 7ff6d09efe20 call 7ff6d09ec850 call 7ff6d09f53f0 call 7ff6d09f5484 call 7ff6d09e36b0 14 7ff6d09e3814-7ff6d09e3836 call 7ff6d09e1950 0->14 15 7ff6d09e3808-7ff6d09e380f 0->15 20 7ff6d09e391b-7ff6d09e3931 call 7ff6d09e45c0 14->20 21 7ff6d09e383c-7ff6d09e3856 call 7ff6d09e1c80 14->21 16 7ff6d09e3c97-7ff6d09e3cb2 call 7ff6d09ec550 15->16 28 7ff6d09e3933-7ff6d09e3960 call 7ff6d09e7f90 20->28 29 7ff6d09e396a-7ff6d09e397f call 7ff6d09e2710 20->29 25 7ff6d09e385b-7ff6d09e389b call 7ff6d09e8830 21->25 35 7ff6d09e38c1-7ff6d09e38cc call 7ff6d09f4f30 25->35 36 7ff6d09e389d-7ff6d09e38a3 25->36 37 7ff6d09e3962-7ff6d09e3965 call 7ff6d09f004c 28->37 38 7ff6d09e3984-7ff6d09e39a6 call 7ff6d09e1c80 28->38 39 7ff6d09e3c8f 29->39 47 7ff6d09e38d2-7ff6d09e38e1 call 7ff6d09e8830 35->47 48 7ff6d09e39fc-7ff6d09e3a2a call 7ff6d09e8940 call 7ff6d09e89a0 * 3 35->48 40 7ff6d09e38a5-7ff6d09e38ad 36->40 41 7ff6d09e38af-7ff6d09e38bd call 7ff6d09e89a0 36->41 37->29 53 7ff6d09e39b0-7ff6d09e39b9 38->53 39->16 40->41 41->35 57 7ff6d09e39f4-7ff6d09e39f7 call 7ff6d09f4f30 47->57 58 7ff6d09e38e7-7ff6d09e38ed 47->58 76 7ff6d09e3a2f-7ff6d09e3a3e call 7ff6d09e8830 48->76 53->53 56 7ff6d09e39bb-7ff6d09e39d8 call 7ff6d09e1950 53->56 56->25 68 7ff6d09e39de-7ff6d09e39ef call 7ff6d09e2710 56->68 57->48 62 7ff6d09e38f0-7ff6d09e38fc 58->62 65 7ff6d09e3905-7ff6d09e3908 62->65 66 7ff6d09e38fe-7ff6d09e3903 62->66 65->57 69 7ff6d09e390e-7ff6d09e3916 call 7ff6d09f4f30 65->69 66->62 66->65 68->39 69->76 79 7ff6d09e3b45-7ff6d09e3b53 76->79 80 7ff6d09e3a44-7ff6d09e3a47 76->80 81 7ff6d09e3a67 79->81 82 7ff6d09e3b59-7ff6d09e3b5d 79->82 80->79 83 7ff6d09e3a4d-7ff6d09e3a50 80->83 84 7ff6d09e3a6b-7ff6d09e3a90 call 7ff6d09f4f30 81->84 82->84 85 7ff6d09e3b14-7ff6d09e3b17 83->85 86 7ff6d09e3a56-7ff6d09e3a5a 83->86 95 7ff6d09e3a92-7ff6d09e3aa6 call 7ff6d09e8940 84->95 96 7ff6d09e3aab-7ff6d09e3ac0 84->96 88 7ff6d09e3b2f-7ff6d09e3b40 call 7ff6d09e2710 85->88 89 7ff6d09e3b19-7ff6d09e3b1d 85->89 86->85 87 7ff6d09e3a60 86->87 87->81 97 7ff6d09e3c7f-7ff6d09e3c87 88->97 89->88 91 7ff6d09e3b1f-7ff6d09e3b2a 89->91 91->84 95->96 99 7ff6d09e3ac6-7ff6d09e3aca 96->99 100 7ff6d09e3be8-7ff6d09e3bfa call 7ff6d09e8830 96->100 97->39 102 7ff6d09e3ad0-7ff6d09e3ae8 call 7ff6d09f5250 99->102 103 7ff6d09e3bcd-7ff6d09e3be2 call 7ff6d09e1940 99->103 108 7ff6d09e3c2e 100->108 109 7ff6d09e3bfc-7ff6d09e3c02 100->109 113 7ff6d09e3b62-7ff6d09e3b7a call 7ff6d09f5250 102->113 114 7ff6d09e3aea-7ff6d09e3b02 call 7ff6d09f5250 102->114 103->99 103->100 115 7ff6d09e3c31-7ff6d09e3c40 call 7ff6d09f4f30 108->115 111 7ff6d09e3c04-7ff6d09e3c1c 109->111 112 7ff6d09e3c1e-7ff6d09e3c2c 109->112 111->115 112->115 124 7ff6d09e3b7c-7ff6d09e3b80 113->124 125 7ff6d09e3b87-7ff6d09e3b9f call 7ff6d09f5250 113->125 114->103 126 7ff6d09e3b08-7ff6d09e3b0f 114->126 122 7ff6d09e3d41-7ff6d09e3d63 call 7ff6d09e44e0 115->122 123 7ff6d09e3c46-7ff6d09e3c4a 115->123 137 7ff6d09e3d65-7ff6d09e3d6f call 7ff6d09e4630 122->137 138 7ff6d09e3d71-7ff6d09e3d82 call 7ff6d09e1c80 122->138 127 7ff6d09e3cd4-7ff6d09e3ce6 call 7ff6d09e8830 123->127 128 7ff6d09e3c50-7ff6d09e3c5f call 7ff6d09e90e0 123->128 124->125 139 7ff6d09e3ba1-7ff6d09e3ba5 125->139 140 7ff6d09e3bac-7ff6d09e3bc4 call 7ff6d09f5250 125->140 126->103 144 7ff6d09e3d35-7ff6d09e3d3c 127->144 145 7ff6d09e3ce8-7ff6d09e3ceb 127->145 142 7ff6d09e3cb3-7ff6d09e3cbd call 7ff6d09e8660 128->142 143 7ff6d09e3c61 128->143 152 7ff6d09e3d87-7ff6d09e3d96 137->152 138->152 139->140 140->103 155 7ff6d09e3bc6 140->155 161 7ff6d09e3cbf-7ff6d09e3cc6 142->161 162 7ff6d09e3cc8-7ff6d09e3ccf 142->162 149 7ff6d09e3c68 call 7ff6d09e2710 143->149 144->149 145->144 150 7ff6d09e3ced-7ff6d09e3d10 call 7ff6d09e1c80 145->150 163 7ff6d09e3c6d-7ff6d09e3c77 149->163 167 7ff6d09e3d12-7ff6d09e3d26 call 7ff6d09e2710 call 7ff6d09f4f30 150->167 168 7ff6d09e3d2b-7ff6d09e3d33 call 7ff6d09f4f30 150->168 158 7ff6d09e3dc4-7ff6d09e3dda call 7ff6d09e9390 152->158 159 7ff6d09e3d98-7ff6d09e3d9f 152->159 155->103 171 7ff6d09e3ddc 158->171 172 7ff6d09e3de8-7ff6d09e3e04 SetDllDirectoryW 158->172 159->158 165 7ff6d09e3da1-7ff6d09e3da5 159->165 161->149 162->152 163->97 165->158 169 7ff6d09e3da7-7ff6d09e3dbe SetDllDirectoryW LoadLibraryExW 165->169 167->163 168->152 169->158 171->172 175 7ff6d09e3f01-7ff6d09e3f08 172->175 176 7ff6d09e3e0a-7ff6d09e3e19 call 7ff6d09e8830 172->176 178 7ff6d09e3f0e-7ff6d09e3f15 175->178 179 7ff6d09e4008-7ff6d09e4010 175->179 189 7ff6d09e3e32-7ff6d09e3e3c call 7ff6d09f4f30 176->189 190 7ff6d09e3e1b-7ff6d09e3e21 176->190 178->179 182 7ff6d09e3f1b-7ff6d09e3f25 call 7ff6d09e33c0 178->182 183 7ff6d09e4012-7ff6d09e402f PostMessageW GetMessageW 179->183 184 7ff6d09e4035-7ff6d09e4040 call 7ff6d09e36a0 call 7ff6d09e3360 179->184 182->163 196 7ff6d09e3f2b-7ff6d09e3f3f call 7ff6d09e90c0 182->196 183->184 200 7ff6d09e4045-7ff6d09e4067 call 7ff6d09e3670 call 7ff6d09e6fc0 call 7ff6d09e6d70 184->200 201 7ff6d09e3ef2-7ff6d09e3efc call 7ff6d09e8940 189->201 202 7ff6d09e3e42-7ff6d09e3e48 189->202 193 7ff6d09e3e23-7ff6d09e3e2b 190->193 194 7ff6d09e3e2d-7ff6d09e3e2f 190->194 193->194 194->189 209 7ff6d09e3f64-7ff6d09e3fa7 call 7ff6d09e8940 call 7ff6d09e89e0 call 7ff6d09e6fc0 call 7ff6d09e6d70 call 7ff6d09e88e0 196->209 210 7ff6d09e3f41-7ff6d09e3f5e PostMessageW GetMessageW 196->210 201->175 202->201 206 7ff6d09e3e4e-7ff6d09e3e54 202->206 207 7ff6d09e3e5f-7ff6d09e3e61 206->207 208 7ff6d09e3e56-7ff6d09e3e58 206->208 207->175 213 7ff6d09e3e67-7ff6d09e3e83 call 7ff6d09e6dc0 call 7ff6d09e7340 207->213 212 7ff6d09e3e5a 208->212 208->213 248 7ff6d09e3ff5-7ff6d09e4003 call 7ff6d09e1900 209->248 249 7ff6d09e3fa9-7ff6d09e3fbf call 7ff6d09e8ed0 call 7ff6d09e88e0 209->249 210->209 212->175 227 7ff6d09e3e85-7ff6d09e3e8c 213->227 228 7ff6d09e3e8e-7ff6d09e3e95 213->228 230 7ff6d09e3edb-7ff6d09e3ef0 call 7ff6d09e2a50 call 7ff6d09e6fc0 call 7ff6d09e6d70 227->230 231 7ff6d09e3eaf-7ff6d09e3eb9 call 7ff6d09e71b0 228->231 232 7ff6d09e3e97-7ff6d09e3ea4 call 7ff6d09e6e00 228->232 230->175 242 7ff6d09e3ec4-7ff6d09e3ed2 call 7ff6d09e74f0 231->242 243 7ff6d09e3ebb-7ff6d09e3ec2 231->243 232->231 246 7ff6d09e3ea6-7ff6d09e3ead 232->246 242->175 256 7ff6d09e3ed4 242->256 243->230 246->230 248->163 249->248 261 7ff6d09e3fc1-7ff6d09e3fd6 249->261 256->230 262 7ff6d09e3ff0 call 7ff6d09e2a50 261->262 263 7ff6d09e3fd8-7ff6d09e3feb call 7ff6d09e2710 call 7ff6d09e1900 261->263 262->248 263->163
                                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000001.00000002.2085594471.00007FF6D09E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D09E0000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000001.00000002.2085569640.00007FF6D09E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000001.00000002.2085629189.00007FF6D0A0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000001.00000002.2085658768.00007FF6D0A1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000001.00000002.2085658768.00007FF6D0A21000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000001.00000002.2085707438.00007FF6D0A24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_7ff6d09e0000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: ErrorFileLastModuleName
                                                                                                                                                                                                                                                        • String ID: Could not create temporary directory!$Could not load PyInstaller's embedded PKG archive from the executable (%s)$Could not side-load PyInstaller's PKG archive from external file (%s)$Failed to convert DLL search path!$Failed to initialize security descriptor for temporary directory!$Failed to load Tcl/Tk shared libraries for splash screen!$Failed to load splash screen resources!$Failed to remove temporary directory: %s$Failed to start splash screen!$Failed to unpack splash screen dependencies from PKG archive!$Invalid value in _PYI_PARENT_PROCESS_LEVEL: %s$MEI$PYINSTALLER_RESET_ENVIRONMENT$PYINSTALLER_STRICT_UNPACK_MODE$PYINSTALLER_SUPPRESS_SPLASH_SCREEN$Path exceeds PYI_PATH_MAX limit.$Py_GIL_DISABLED$VCRUNTIME140.dll$_PYI_APPLICATION_HOME_DIR$_PYI_APPLICATION_HOME_DIR not set for onefile child process!$_PYI_ARCHIVE_FILE$_PYI_PARENT_PROCESS_LEVEL$_PYI_SPLASH_IPC$pkg$pyi-contents-directory$pyi-disable-windowed-traceback$pyi-python-flag$pyi-runtime-tmpdir
                                                                                                                                                                                                                                                        • API String ID: 2776309574-4232158417
                                                                                                                                                                                                                                                        • Opcode ID: d52c1960cc45de78c26c9f57622ace5a14626686e839aa839f1fc42fe00fc1f1
                                                                                                                                                                                                                                                        • Instruction ID: a6592dbe3827e356133bab30d7f88d9f2a4431c85bc425dbf9a034c6d1eec82a
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: d52c1960cc45de78c26c9f57622ace5a14626686e839aa839f1fc42fe00fc1f1
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 1C326D22A0E686B1EA19D721D5582BD2651BF44788F84A037DA5DCB3DFDF2CE974C300
                                                                                                                                                                                                                                                        Function 00007FF6D0A06964 Relevance: 13.8, APIs: 9, Instructions: 276fileCOMMON
                                                                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                                                                        control_flow_graph 467 7ff6d0a06964-7ff6d0a069d7 call 7ff6d0a06698 470 7ff6d0a069f1-7ff6d0a069fb call 7ff6d09f8520 467->470 471 7ff6d0a069d9-7ff6d0a069e2 call 7ff6d09f4ee8 467->471 476 7ff6d0a069fd-7ff6d0a06a14 call 7ff6d09f4ee8 call 7ff6d09f4f08 470->476 477 7ff6d0a06a16-7ff6d0a06a7f CreateFileW 470->477 478 7ff6d0a069e5-7ff6d0a069ec call 7ff6d09f4f08 471->478 476->478 480 7ff6d0a06a81-7ff6d0a06a87 477->480 481 7ff6d0a06afc-7ff6d0a06b07 GetFileType 477->481 489 7ff6d0a06d32-7ff6d0a06d52 478->489 486 7ff6d0a06ac9-7ff6d0a06af7 GetLastError call 7ff6d09f4e7c 480->486 487 7ff6d0a06a89-7ff6d0a06a8d 480->487 483 7ff6d0a06b5a-7ff6d0a06b61 481->483 484 7ff6d0a06b09-7ff6d0a06b44 GetLastError call 7ff6d09f4e7c CloseHandle 481->484 492 7ff6d0a06b63-7ff6d0a06b67 483->492 493 7ff6d0a06b69-7ff6d0a06b6c 483->493 484->478 501 7ff6d0a06b4a-7ff6d0a06b55 call 7ff6d09f4f08 484->501 486->478 487->486 494 7ff6d0a06a8f-7ff6d0a06ac7 CreateFileW 487->494 498 7ff6d0a06b72-7ff6d0a06bc7 call 7ff6d09f8438 492->498 493->498 499 7ff6d0a06b6e 493->499 494->481 494->486 506 7ff6d0a06bc9-7ff6d0a06bd5 call 7ff6d0a068a0 498->506 507 7ff6d0a06be6-7ff6d0a06c17 call 7ff6d0a06418 498->507 499->498 501->478 506->507 512 7ff6d0a06bd7 506->512 513 7ff6d0a06c1d-7ff6d0a06c5f 507->513 514 7ff6d0a06c19-7ff6d0a06c1b 507->514 515 7ff6d0a06bd9-7ff6d0a06be1 call 7ff6d09faac0 512->515 516 7ff6d0a06c81-7ff6d0a06c8c 513->516 517 7ff6d0a06c61-7ff6d0a06c65 513->517 514->515 515->489 520 7ff6d0a06c92-7ff6d0a06c96 516->520 521 7ff6d0a06d30 516->521 517->516 519 7ff6d0a06c67-7ff6d0a06c7c 517->519 519->516 520->521 523 7ff6d0a06c9c-7ff6d0a06ce1 CloseHandle CreateFileW 520->523 521->489 524 7ff6d0a06ce3-7ff6d0a06d11 GetLastError call 7ff6d09f4e7c call 7ff6d09f8660 523->524 525 7ff6d0a06d16-7ff6d0a06d2b 523->525 524->525 525->521
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000001.00000002.2085594471.00007FF6D09E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D09E0000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000001.00000002.2085569640.00007FF6D09E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000001.00000002.2085629189.00007FF6D0A0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000001.00000002.2085658768.00007FF6D0A1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000001.00000002.2085658768.00007FF6D0A21000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000001.00000002.2085707438.00007FF6D0A24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_7ff6d09e0000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
                                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                                        • API String ID: 1617910340-0
                                                                                                                                                                                                                                                        • Opcode ID: baaa1bd2bfcf3e8d87424e6061cd652f961a4b3dae6ad7eaae94581ee29caa63
                                                                                                                                                                                                                                                        • Instruction ID: 164288afb55d3a770f19b57e4f06bf6d42ae9702afe0eadfec71595e560aba31
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: baaa1bd2bfcf3e8d87424e6061cd652f961a4b3dae6ad7eaae94581ee29caa63
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 66C1B133B28A4595EB14CF6AC4912AD3765F749B98F05523ADE2E9B79ECF38D061C300
                                                                                                                                                                                                                                                        Function 00007FF6D09E9280 Relevance: 3.0, APIs: 2, Instructions: 29COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000001.00000002.2085594471.00007FF6D09E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D09E0000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000001.00000002.2085569640.00007FF6D09E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000001.00000002.2085629189.00007FF6D0A0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000001.00000002.2085658768.00007FF6D0A1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000001.00000002.2085658768.00007FF6D0A21000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000001.00000002.2085707438.00007FF6D0A24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_7ff6d09e0000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: Find$CloseFileFirst
                                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                                        • API String ID: 2295610775-0
                                                                                                                                                                                                                                                        • Opcode ID: 3849ca1beccae91a12aeced599bc73bdbec409d6dd090ca7d2ec6d5d284a4285
                                                                                                                                                                                                                                                        • Instruction ID: 0a9c964f69650bd0d8743b18a6d3717ae02265dabd5718434ec87261d38c95a2
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 3849ca1beccae91a12aeced599bc73bdbec409d6dd090ca7d2ec6d5d284a4285
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 36F0C832A1D74196FB608B60B49876E7390BB84328F041337DA7D867D9DF7CD469CA00
                                                                                                                                                                                                                                                        Function 00007FF6D09E1950 Relevance: 22.9, APIs: 2, Strings: 11, Instructions: 184COMMON
                                                                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                                                                        control_flow_graph 269 7ff6d09e1950-7ff6d09e198b call 7ff6d09e45c0 272 7ff6d09e1c4e-7ff6d09e1c72 call 7ff6d09ec550 269->272 273 7ff6d09e1991-7ff6d09e19d1 call 7ff6d09e7f90 269->273 278 7ff6d09e1c3b-7ff6d09e1c3e call 7ff6d09f004c 273->278 279 7ff6d09e19d7-7ff6d09e19e7 call 7ff6d09f06d4 273->279 283 7ff6d09e1c43-7ff6d09e1c4b 278->283 284 7ff6d09e19e9-7ff6d09e1a03 call 7ff6d09f4f08 call 7ff6d09e2910 279->284 285 7ff6d09e1a08-7ff6d09e1a24 call 7ff6d09f039c 279->285 283->272 284->278 291 7ff6d09e1a45-7ff6d09e1a5a call 7ff6d09f4f28 285->291 292 7ff6d09e1a26-7ff6d09e1a40 call 7ff6d09f4f08 call 7ff6d09e2910 285->292 298 7ff6d09e1a7b-7ff6d09e1b05 call 7ff6d09e1c80 * 2 call 7ff6d09f06d4 call 7ff6d09f4f44 291->298 299 7ff6d09e1a5c-7ff6d09e1a76 call 7ff6d09f4f08 call 7ff6d09e2910 291->299 292->278 313 7ff6d09e1b0a-7ff6d09e1b14 298->313 299->278 314 7ff6d09e1b35-7ff6d09e1b4e call 7ff6d09f039c 313->314 315 7ff6d09e1b16-7ff6d09e1b30 call 7ff6d09f4f08 call 7ff6d09e2910 313->315 321 7ff6d09e1b6f-7ff6d09e1b8b call 7ff6d09f0110 314->321 322 7ff6d09e1b50-7ff6d09e1b6a call 7ff6d09f4f08 call 7ff6d09e2910 314->322 315->278 328 7ff6d09e1b9e-7ff6d09e1bac 321->328 329 7ff6d09e1b8d-7ff6d09e1b99 call 7ff6d09e2710 321->329 322->278 328->278 332 7ff6d09e1bb2-7ff6d09e1bb9 328->332 329->278 335 7ff6d09e1bc1-7ff6d09e1bc7 332->335 336 7ff6d09e1be0-7ff6d09e1bef 335->336 337 7ff6d09e1bc9-7ff6d09e1bd6 335->337 336->336 338 7ff6d09e1bf1-7ff6d09e1bfa 336->338 337->338 339 7ff6d09e1c0f 338->339 340 7ff6d09e1bfc-7ff6d09e1bff 338->340 341 7ff6d09e1c11-7ff6d09e1c24 339->341 340->339 342 7ff6d09e1c01-7ff6d09e1c04 340->342 343 7ff6d09e1c2d-7ff6d09e1c39 341->343 344 7ff6d09e1c26 341->344 342->339 345 7ff6d09e1c06-7ff6d09e1c09 342->345 343->278 343->335 344->343 345->339 346 7ff6d09e1c0b-7ff6d09e1c0d 345->346 346->341
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                          • Part of subcall function 00007FF6D09E7F90: _fread_nolock.LIBCMT ref: 00007FF6D09E803A
                                                                                                                                                                                                                                                        • _fread_nolock.LIBCMT ref: 00007FF6D09E1A1B
                                                                                                                                                                                                                                                          • Part of subcall function 00007FF6D09E2910: GetCurrentProcessId.KERNEL32(?,?,?,?,00000000,00000000,?,00000000,00007FF6D09E1B6A), ref: 00007FF6D09E295E
                                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000001.00000002.2085594471.00007FF6D09E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D09E0000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000001.00000002.2085569640.00007FF6D09E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000001.00000002.2085629189.00007FF6D0A0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000001.00000002.2085658768.00007FF6D0A1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000001.00000002.2085658768.00007FF6D0A21000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000001.00000002.2085707438.00007FF6D0A24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_7ff6d09e0000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: _fread_nolock$CurrentProcess
                                                                                                                                                                                                                                                        • String ID: Could not allocate buffer for TOC!$Could not allocate memory for archive structure!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$MEI$calloc$fread$fseek$malloc
                                                                                                                                                                                                                                                        • API String ID: 2397952137-3497178890
                                                                                                                                                                                                                                                        • Opcode ID: ee3080450604db9b79bcaf6ea9780d01564dfb64de786eed8711188a6f6cabc7
                                                                                                                                                                                                                                                        • Instruction ID: 3b6ab2d8e24f5d1667d40138e1b6b8dce6d1b3c827b625028375aa5aaed2ee66
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: ee3080450604db9b79bcaf6ea9780d01564dfb64de786eed8711188a6f6cabc7
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: E881B371A1D686A6EB14DB15D0412BD2390FF88788F545433E98DCB79FDE3CE9658700
                                                                                                                                                                                                                                                        Function 00007FF6D09E1470 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 107COMMON
                                                                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000001.00000002.2085594471.00007FF6D09E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D09E0000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000001.00000002.2085569640.00007FF6D09E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000001.00000002.2085629189.00007FF6D0A0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000001.00000002.2085658768.00007FF6D0A1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000001.00000002.2085658768.00007FF6D0A21000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000001.00000002.2085707438.00007FF6D0A24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_7ff6d09e0000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: CurrentProcess
                                                                                                                                                                                                                                                        • String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
                                                                                                                                                                                                                                                        • API String ID: 2050909247-3659356012
                                                                                                                                                                                                                                                        • Opcode ID: 3b379cfcfb123380b7207fe9b70de138e86c6d94a3f87720caf8569e0a5fbbd0
                                                                                                                                                                                                                                                        • Instruction ID: 6091c37d81cf057244d10fe1457fce88128514ce4b171ec3fb90f57ae6fca4ed
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 3b379cfcfb123380b7207fe9b70de138e86c6d94a3f87720caf8569e0a5fbbd0
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 80419D32A19642A6EB00DB2295005BD6394FF84788F846533FE0DCBB9FDE3CE9658700
                                                                                                                                                                                                                                                        Function 00007FF6D09E1210 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 158COMMON
                                                                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                                                                        control_flow_graph 530 7ff6d09e1210-7ff6d09e126d call 7ff6d09ebd80 533 7ff6d09e126f-7ff6d09e1296 call 7ff6d09e2710 530->533 534 7ff6d09e1297-7ff6d09e12af call 7ff6d09f4f44 530->534 539 7ff6d09e12d4-7ff6d09e12e4 call 7ff6d09f4f44 534->539 540 7ff6d09e12b1-7ff6d09e12cf call 7ff6d09f4f08 call 7ff6d09e2910 534->540 545 7ff6d09e12e6-7ff6d09e1304 call 7ff6d09f4f08 call 7ff6d09e2910 539->545 546 7ff6d09e1309-7ff6d09e131b 539->546 553 7ff6d09e1439-7ff6d09e146d call 7ff6d09eba60 call 7ff6d09f4f30 * 2 540->553 545->553 549 7ff6d09e1320-7ff6d09e133d call 7ff6d09f039c 546->549 556 7ff6d09e1342-7ff6d09e1345 549->556 559 7ff6d09e1431 556->559 560 7ff6d09e134b-7ff6d09e1355 call 7ff6d09f0110 556->560 559->553 560->559 566 7ff6d09e135b-7ff6d09e1367 560->566 568 7ff6d09e1370-7ff6d09e1398 call 7ff6d09ea1c0 566->568 571 7ff6d09e139a-7ff6d09e139d 568->571 572 7ff6d09e1416-7ff6d09e142c call 7ff6d09e2710 568->572 573 7ff6d09e139f-7ff6d09e13a9 571->573 574 7ff6d09e1411 571->574 572->559 576 7ff6d09e13d4-7ff6d09e13d7 573->576 577 7ff6d09e13ab-7ff6d09e13c1 call 7ff6d09f0adc 573->577 574->572 579 7ff6d09e13ea-7ff6d09e13ef 576->579 580 7ff6d09e13d9-7ff6d09e13e7 call 7ff6d0a09e30 576->580 584 7ff6d09e13c3-7ff6d09e13cd call 7ff6d09f0110 577->584 585 7ff6d09e13cf-7ff6d09e13d2 577->585 579->568 583 7ff6d09e13f5-7ff6d09e13f8 579->583 580->579 587 7ff6d09e13fa-7ff6d09e13fd 583->587 588 7ff6d09e140c-7ff6d09e140f 583->588 584->579 584->585 585->572 587->572 589 7ff6d09e13ff-7ff6d09e1407 587->589 588->559 589->549
                                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000001.00000002.2085594471.00007FF6D09E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D09E0000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000001.00000002.2085569640.00007FF6D09E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000001.00000002.2085629189.00007FF6D0A0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000001.00000002.2085658768.00007FF6D0A1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000001.00000002.2085658768.00007FF6D0A21000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000001.00000002.2085707438.00007FF6D0A24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_7ff6d09e0000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: CurrentProcess
                                                                                                                                                                                                                                                        • String ID: 1.3.1$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$malloc
                                                                                                                                                                                                                                                        • API String ID: 2050909247-2813020118
                                                                                                                                                                                                                                                        • Opcode ID: 9b2da8e32cee601306ebcebf5d16e93c03482fa50eddd1a53150bf2cf71a648a
                                                                                                                                                                                                                                                        • Instruction ID: 260760d33eb09f9417d8b0b525b0475f77f359b53f13aae4cd8130d4d30d18da
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 9b2da8e32cee601306ebcebf5d16e93c03482fa50eddd1a53150bf2cf71a648a
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 4851C632A0E642A5E6249B12A4403BE6691FF84798F446137ED4DCB7DFEE3CE961C700
                                                                                                                                                                                                                                                        Function 00007FF6D09E36B0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 61COMMON
                                                                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        • GetModuleFileNameW.KERNEL32(?,00007FF6D09E3804), ref: 00007FF6D09E36E1
                                                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,00007FF6D09E3804), ref: 00007FF6D09E36EB
                                                                                                                                                                                                                                                          • Part of subcall function 00007FF6D09E2C50: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF6D09E3706,?,00007FF6D09E3804), ref: 00007FF6D09E2C9E
                                                                                                                                                                                                                                                          • Part of subcall function 00007FF6D09E2C50: FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF6D09E3706,?,00007FF6D09E3804), ref: 00007FF6D09E2D63
                                                                                                                                                                                                                                                          • Part of subcall function 00007FF6D09E2C50: MessageBoxW.USER32 ref: 00007FF6D09E2D99
                                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000001.00000002.2085594471.00007FF6D09E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D09E0000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000001.00000002.2085569640.00007FF6D09E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000001.00000002.2085629189.00007FF6D0A0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000001.00000002.2085658768.00007FF6D0A1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000001.00000002.2085658768.00007FF6D0A21000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000001.00000002.2085707438.00007FF6D0A24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_7ff6d09e0000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: Message$CurrentErrorFileFormatLastModuleNameProcess
                                                                                                                                                                                                                                                        • String ID: Failed to convert executable path to UTF-8.$Failed to obtain executable path.$Failed to resolve full path to executable %ls.$GetModuleFileNameW$\\?\
                                                                                                                                                                                                                                                        • API String ID: 3187769757-2863816727
                                                                                                                                                                                                                                                        • Opcode ID: 7a7bb6314ef99d1ea6b5a99dff4d55fbb7227be169d5ba9e119ffda366a0a745
                                                                                                                                                                                                                                                        • Instruction ID: 3b16a2486419b671d8efc8867afbb449ba1c1740344d1d912b63513927b24d8f
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 7a7bb6314ef99d1ea6b5a99dff4d55fbb7227be169d5ba9e119ffda366a0a745
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 7C2197A1B2D64271FA24D721E8143BE2250BF48358F445133E65DCA7DFEE6CE925C300
                                                                                                                                                                                                                                                        Function 00007FF6D09FBA5C Relevance: 10.8, APIs: 7, Instructions: 290COMMONLIBRARYCODE
                                                                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                                                                        control_flow_graph 691 7ff6d09fba5c-7ff6d09fba82 692 7ff6d09fba84-7ff6d09fba98 call 7ff6d09f4ee8 call 7ff6d09f4f08 691->692 693 7ff6d09fba9d-7ff6d09fbaa1 691->693 709 7ff6d09fbe8e 692->709 695 7ff6d09fbe77-7ff6d09fbe83 call 7ff6d09f4ee8 call 7ff6d09f4f08 693->695 696 7ff6d09fbaa7-7ff6d09fbaae 693->696 715 7ff6d09fbe89 _invalid_parameter_noinfo 695->715 696->695 699 7ff6d09fbab4-7ff6d09fbae2 696->699 699->695 702 7ff6d09fbae8-7ff6d09fbaef 699->702 705 7ff6d09fbaf1-7ff6d09fbb03 call 7ff6d09f4ee8 call 7ff6d09f4f08 702->705 706 7ff6d09fbb08-7ff6d09fbb0b 702->706 705->715 707 7ff6d09fbe73-7ff6d09fbe75 706->707 708 7ff6d09fbb11-7ff6d09fbb17 706->708 713 7ff6d09fbe91-7ff6d09fbea8 707->713 708->707 714 7ff6d09fbb1d-7ff6d09fbb20 708->714 709->713 714->705 717 7ff6d09fbb22-7ff6d09fbb47 714->717 715->709 719 7ff6d09fbb7a-7ff6d09fbb81 717->719 720 7ff6d09fbb49-7ff6d09fbb4b 717->720 721 7ff6d09fbb83-7ff6d09fbbab call 7ff6d09fd5fc call 7ff6d09fa948 * 2 719->721 722 7ff6d09fbb56-7ff6d09fbb6d call 7ff6d09f4ee8 call 7ff6d09f4f08 _invalid_parameter_noinfo 719->722 723 7ff6d09fbb72-7ff6d09fbb78 720->723 724 7ff6d09fbb4d-7ff6d09fbb54 720->724 752 7ff6d09fbbad-7ff6d09fbbc3 call 7ff6d09f4f08 call 7ff6d09f4ee8 721->752 753 7ff6d09fbbc8-7ff6d09fbbf3 call 7ff6d09fc284 721->753 744 7ff6d09fbd00 722->744 727 7ff6d09fbbf8-7ff6d09fbc0f 723->727 724->722 724->723 728 7ff6d09fbc11-7ff6d09fbc19 727->728 729 7ff6d09fbc8a-7ff6d09fbc94 call 7ff6d0a0391c 727->729 728->729 732 7ff6d09fbc1b-7ff6d09fbc1d 728->732 742 7ff6d09fbd1e 729->742 743 7ff6d09fbc9a-7ff6d09fbcaf 729->743 732->729 736 7ff6d09fbc1f-7ff6d09fbc35 732->736 736->729 740 7ff6d09fbc37-7ff6d09fbc43 736->740 740->729 745 7ff6d09fbc45-7ff6d09fbc47 740->745 748 7ff6d09fbd23-7ff6d09fbd43 ReadFile 742->748 743->742 749 7ff6d09fbcb1-7ff6d09fbcc3 GetConsoleMode 743->749 746 7ff6d09fbd03-7ff6d09fbd0d call 7ff6d09fa948 744->746 745->729 750 7ff6d09fbc49-7ff6d09fbc61 745->750 746->713 754 7ff6d09fbe3d-7ff6d09fbe46 GetLastError 748->754 755 7ff6d09fbd49-7ff6d09fbd51 748->755 749->742 756 7ff6d09fbcc5-7ff6d09fbccd 749->756 750->729 759 7ff6d09fbc63-7ff6d09fbc6f 750->759 752->744 753->727 757 7ff6d09fbe63-7ff6d09fbe66 754->757 758 7ff6d09fbe48-7ff6d09fbe5e call 7ff6d09f4f08 call 7ff6d09f4ee8 754->758 755->754 762 7ff6d09fbd57 755->762 756->748 764 7ff6d09fbccf-7ff6d09fbcf1 ReadConsoleW 756->764 769 7ff6d09fbe6c-7ff6d09fbe6e 757->769 770 7ff6d09fbcf9-7ff6d09fbcfb call 7ff6d09f4e7c 757->770 758->744 759->729 768 7ff6d09fbc71-7ff6d09fbc73 759->768 772 7ff6d09fbd5e-7ff6d09fbd73 762->772 765 7ff6d09fbcf3 GetLastError 764->765 766 7ff6d09fbd12-7ff6d09fbd1c 764->766 765->770 766->772 768->729 776 7ff6d09fbc75-7ff6d09fbc85 768->776 769->746 770->744 772->746 778 7ff6d09fbd75-7ff6d09fbd80 772->778 776->729 781 7ff6d09fbd82-7ff6d09fbd9b call 7ff6d09fb674 778->781 782 7ff6d09fbda7-7ff6d09fbdaf 778->782 787 7ff6d09fbda0-7ff6d09fbda2 781->787 783 7ff6d09fbdb1-7ff6d09fbdc3 782->783 784 7ff6d09fbe2b-7ff6d09fbe38 call 7ff6d09fb4b4 782->784 788 7ff6d09fbdc5 783->788 789 7ff6d09fbe1e-7ff6d09fbe26 783->789 784->787 787->746 792 7ff6d09fbdca-7ff6d09fbdd1 788->792 789->746 793 7ff6d09fbdd3-7ff6d09fbdd7 792->793 794 7ff6d09fbe0d-7ff6d09fbe18 792->794 795 7ff6d09fbdf3 793->795 796 7ff6d09fbdd9-7ff6d09fbde0 793->796 794->789 798 7ff6d09fbdf9-7ff6d09fbe09 795->798 796->795 797 7ff6d09fbde2-7ff6d09fbde6 796->797 797->795 799 7ff6d09fbde8-7ff6d09fbdf1 797->799 798->792 800 7ff6d09fbe0b 798->800 799->798 800->789
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000001.00000002.2085594471.00007FF6D09E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D09E0000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000001.00000002.2085569640.00007FF6D09E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000001.00000002.2085629189.00007FF6D0A0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000001.00000002.2085658768.00007FF6D0A1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000001.00000002.2085658768.00007FF6D0A21000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000001.00000002.2085707438.00007FF6D0A24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_7ff6d09e0000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                                        • API String ID: 3215553584-0
                                                                                                                                                                                                                                                        • Opcode ID: c3f57b6cd1f658b3a1cfdd45bc75f21d2f6c8be166295f0eb40444005b392bd6
                                                                                                                                                                                                                                                        • Instruction ID: d0f5e870961ecdb69b579d92d072ece4f6c29e809a174e55abb5730ca3738a0b
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: c3f57b6cd1f658b3a1cfdd45bc75f21d2f6c8be166295f0eb40444005b392bd6
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 54C1E2A2A1C686A1E7608F1590402BD2F58FB81B88F596133FB4D8B7DBCE7CE4658701
                                                                                                                                                                                                                                                        Function 00007FF6D09E6360 Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 82COMMON
                                                                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000001.00000002.2085594471.00007FF6D09E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D09E0000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000001.00000002.2085569640.00007FF6D09E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000001.00000002.2085629189.00007FF6D0A0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000001.00000002.2085658768.00007FF6D0A1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000001.00000002.2085658768.00007FF6D0A21000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000001.00000002.2085707438.00007FF6D0A24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_7ff6d09e0000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: CurrentProcess
                                                                                                                                                                                                                                                        • String ID: Failed to load Python DLL '%ls'.$LoadLibrary$Path of Python shared library (%s) and its name (%s) exceed buffer size (%d)$Path of ucrtbase.dll (%s) and its name exceed buffer size (%d)$Reported length (%d) of Python shared library name (%s) exceeds buffer size (%d)$ucrtbase.dll
                                                                                                                                                                                                                                                        • API String ID: 2050909247-2434346643
                                                                                                                                                                                                                                                        • Opcode ID: 111e0a7e53993944da2df5d9c96cd3a7cea32e86f931b773c4ccd6a62d35c348
                                                                                                                                                                                                                                                        • Instruction ID: a8dff007917e73dbdc5ece4918793b2b4433f85c2bee3ee8dd48ab968a4dca4e
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 111e0a7e53993944da2df5d9c96cd3a7cea32e86f931b773c4ccd6a62d35c348
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: B5415E22A1D686A1EA15DB21E4152ED6321FB44388F801137DA5CCB7DFEE3CE925C740
                                                                                                                                                                                                                                                        Function 00007FF6D09F5628 Relevance: 6.1, APIs: 4, Instructions: 90fileCOMMON
                                                                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000001.00000002.2085594471.00007FF6D09E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D09E0000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000001.00000002.2085569640.00007FF6D09E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000001.00000002.2085629189.00007FF6D0A0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000001.00000002.2085658768.00007FF6D0A1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000001.00000002.2085658768.00007FF6D0A21000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000001.00000002.2085707438.00007FF6D0A24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_7ff6d09e0000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: CloseCreateFileHandle_invalid_parameter_noinfo
                                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                                        • API String ID: 1279662727-0
                                                                                                                                                                                                                                                        • Opcode ID: b1746a8a916bbf96797ffba89da9809a683c49b2a7b1d8f7dd6efe5c63c8eb6a
                                                                                                                                                                                                                                                        • Instruction ID: 8207ddf213b62286ef31a54824ffda3cd2178eed9a6a339f252017f985c09197
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: b1746a8a916bbf96797ffba89da9809a683c49b2a7b1d8f7dd6efe5c63c8eb6a
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 2D419322D1C78193E7149B21951036D6B64FB943A8F10A336F76C87BDADF6CA4F08740
                                                                                                                                                                                                                                                        Function 00007FF6D09ECC3C Relevance: 4.6, APIs: 3, Instructions: 94COMMON
                                                                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000001.00000002.2085594471.00007FF6D09E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D09E0000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000001.00000002.2085569640.00007FF6D09E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000001.00000002.2085629189.00007FF6D0A0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000001.00000002.2085658768.00007FF6D0A1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000001.00000002.2085658768.00007FF6D0A21000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000001.00000002.2085707438.00007FF6D0A24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_7ff6d09e0000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_release_startup_lock
                                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                                        • API String ID: 3251591375-0
                                                                                                                                                                                                                                                        • Opcode ID: b3dd18574e8b698ea28c35ed35ed65a6730a16d6ac14c38d0a8ba428da0d66bc
                                                                                                                                                                                                                                                        • Instruction ID: a7d2a048248f6d508b3a0be5e0e02a06281e700e388e7283e36ccbb0fbdee2f2
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: b3dd18574e8b698ea28c35ed35ed65a6730a16d6ac14c38d0a8ba428da0d66bc
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 0A313961E0E24661FA18AB75A9113BD1681BF4138CF446437E98ECF3DFDE6DAD668200
                                                                                                                                                                                                                                                        Function 00007FF6D09F013C Relevance: 3.2, APIs: 2, Instructions: 177COMMONLIBRARYCODE
                                                                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                                                                        control_flow_graph 955 7ff6d09f013c-7ff6d09f0169 956 7ff6d09f0185 955->956 957 7ff6d09f016b-7ff6d09f016e 955->957 959 7ff6d09f0187-7ff6d09f019b 956->959 957->956 958 7ff6d09f0170-7ff6d09f0173 957->958 960 7ff6d09f0175-7ff6d09f017a call 7ff6d09f4f08 958->960 961 7ff6d09f019c-7ff6d09f019f 958->961 973 7ff6d09f0180 _invalid_parameter_noinfo 960->973 963 7ff6d09f01a1-7ff6d09f01ad 961->963 964 7ff6d09f01af-7ff6d09f01b3 961->964 963->964 968 7ff6d09f01da-7ff6d09f01e3 963->968 965 7ff6d09f01b5-7ff6d09f01bf call 7ff6d0a0a4d0 964->965 966 7ff6d09f01c7-7ff6d09f01ca 964->966 965->966 966->960 970 7ff6d09f01cc-7ff6d09f01d8 966->970 971 7ff6d09f01e5-7ff6d09f01e8 968->971 972 7ff6d09f01ea 968->972 970->960 970->968 975 7ff6d09f01ef-7ff6d09f020e 971->975 972->975 973->956 976 7ff6d09f0214-7ff6d09f0222 975->976 977 7ff6d09f0355-7ff6d09f0358 975->977 978 7ff6d09f0224-7ff6d09f022b 976->978 979 7ff6d09f029a-7ff6d09f029f 976->979 977->959 978->979 980 7ff6d09f022d 978->980 981 7ff6d09f02a1-7ff6d09f02ad 979->981 982 7ff6d09f030c-7ff6d09f030f call 7ff6d09fbeac 979->982 984 7ff6d09f0233-7ff6d09f023d 980->984 985 7ff6d09f0380 980->985 986 7ff6d09f02af-7ff6d09f02b6 981->986 987 7ff6d09f02b9-7ff6d09f02bf 981->987 989 7ff6d09f0314-7ff6d09f0317 982->989 990 7ff6d09f0243-7ff6d09f0249 984->990 991 7ff6d09f035d-7ff6d09f0361 984->991 988 7ff6d09f0385-7ff6d09f0390 985->988 986->987 987->991 992 7ff6d09f02c5-7ff6d09f02e2 call 7ff6d09fa47c call 7ff6d09fba5c 987->992 988->959 989->988 993 7ff6d09f0319-7ff6d09f031c 989->993 994 7ff6d09f0281-7ff6d09f0295 990->994 995 7ff6d09f024b-7ff6d09f024e 990->995 996 7ff6d09f0363-7ff6d09f036b call 7ff6d0a0a4d0 991->996 997 7ff6d09f0370-7ff6d09f037b call 7ff6d09f4f08 991->997 1013 7ff6d09f02e7-7ff6d09f02e9 992->1013 993->991 1001 7ff6d09f031e-7ff6d09f0335 993->1001 1002 7ff6d09f033c-7ff6d09f0347 994->1002 1003 7ff6d09f0250-7ff6d09f0256 995->1003 1004 7ff6d09f026c-7ff6d09f0277 call 7ff6d09f4f08 _invalid_parameter_noinfo 995->1004 996->997 997->973 1001->1002 1002->976 1011 7ff6d09f034d 1002->1011 1006 7ff6d09f0262-7ff6d09f0267 call 7ff6d0a0a4d0 1003->1006 1007 7ff6d09f0258-7ff6d09f0260 call 7ff6d0a09e30 1003->1007 1019 7ff6d09f027c 1004->1019 1006->1004 1007->1019 1011->977 1017 7ff6d09f0395-7ff6d09f039a 1013->1017 1018 7ff6d09f02ef 1013->1018 1017->988 1018->985 1020 7ff6d09f02f5-7ff6d09f030a 1018->1020 1019->994 1020->1002
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000001.00000002.2085594471.00007FF6D09E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D09E0000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000001.00000002.2085569640.00007FF6D09E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000001.00000002.2085629189.00007FF6D0A0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000001.00000002.2085658768.00007FF6D0A1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000001.00000002.2085658768.00007FF6D0A21000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000001.00000002.2085707438.00007FF6D0A24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_7ff6d09e0000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                                        • API String ID: 3215553584-0
                                                                                                                                                                                                                                                        • Opcode ID: e80cfa20b6c7ebf2f27a6dba6ddb06cb01cda21135ba71ef9e2cf3b7629ca058
                                                                                                                                                                                                                                                        • Instruction ID: 3ba98800e2438041b7089719095d91e17a7ccc7fd5bc68e8dde435f04594deaf
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: e80cfa20b6c7ebf2f27a6dba6ddb06cb01cda21135ba71ef9e2cf3b7629ca058
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 8E51FB61B0D241A6EB249A2594006BE699DAFC4BACF185736FD7D8B7CFCE7CD4218600
                                                                                                                                                                                                                                                        Function 00007FF6D09FC134 Relevance: 3.0, APIs: 2, Instructions: 46COMMON
                                                                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000001.00000002.2085594471.00007FF6D09E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D09E0000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000001.00000002.2085569640.00007FF6D09E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000001.00000002.2085629189.00007FF6D0A0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000001.00000002.2085658768.00007FF6D0A1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000001.00000002.2085658768.00007FF6D0A21000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000001.00000002.2085707438.00007FF6D0A24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_7ff6d09e0000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: ErrorFileLastPointer
                                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                                        • API String ID: 2976181284-0
                                                                                                                                                                                                                                                        • Opcode ID: 7d52f85de62641260209e8dbb28c5e1251e01e8bf24b4306ce9dcd9badf2c9c6
                                                                                                                                                                                                                                                        • Instruction ID: d238907b49e4411a3c4a032298d3ac7898e4209dda65b92951ff635e8a1ea88f
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 7d52f85de62641260209e8dbb28c5e1251e01e8bf24b4306ce9dcd9badf2c9c6
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 6C11046271CA8191DB208B25A90016D6765BB41FF8F645332FE7D8BBDECE3CD0218700
                                                                                                                                                                                                                                                        Function 00007FF6D09FAB58 Relevance: 2.6, APIs: 2, Instructions: 59COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        • CloseHandle.KERNEL32(?,?,?,00007FF6D09FA9D5,?,?,00000000,00007FF6D09FAA8A), ref: 00007FF6D09FABC6
                                                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,?,?,00007FF6D09FA9D5,?,?,00000000,00007FF6D09FAA8A), ref: 00007FF6D09FABD0
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000001.00000002.2085594471.00007FF6D09E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D09E0000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000001.00000002.2085569640.00007FF6D09E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000001.00000002.2085629189.00007FF6D0A0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000001.00000002.2085658768.00007FF6D0A1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000001.00000002.2085658768.00007FF6D0A21000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000001.00000002.2085707438.00007FF6D0A24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_7ff6d09e0000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: CloseErrorHandleLast
                                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                                        • API String ID: 918212764-0
                                                                                                                                                                                                                                                        • Opcode ID: ae1e15d82824e1a5fac1c7302ca2ff5641fe0b0e43db7728cd9339717749910c
                                                                                                                                                                                                                                                        • Instruction ID: 10f73f27735533cba41b578d87d61c40df1ef3133d5472388822586f5c16af7b
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: ae1e15d82824e1a5fac1c7302ca2ff5641fe0b0e43db7728cd9339717749910c
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 2521C951F1C64261FAA4576194543BD1A8A9FC4798F186237F92ECF7DFCE6CA4614300
                                                                                                                                                                                                                                                        Function 00007FF6D09FBEAC Relevance: 1.6, APIs: 1, Instructions: 112COMMONLIBRARYCODE
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000001.00000002.2085594471.00007FF6D09E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D09E0000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000001.00000002.2085569640.00007FF6D09E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000001.00000002.2085629189.00007FF6D0A0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000001.00000002.2085658768.00007FF6D0A1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000001.00000002.2085658768.00007FF6D0A21000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000001.00000002.2085707438.00007FF6D0A24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_7ff6d09e0000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                                        • API String ID: 3215553584-0
                                                                                                                                                                                                                                                        • Opcode ID: 5a303e376ae32d58fd1e52f1ac99a64fdc1cf63549abbe0bdd4da132c2ec767e
                                                                                                                                                                                                                                                        • Instruction ID: 9d1a119f948d68553afad26f395d4f1d26af57d6bf199e851f100e1bc2ac7e36
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 5a303e376ae32d58fd1e52f1ac99a64fdc1cf63549abbe0bdd4da132c2ec767e
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 0D41E57291824193EA34DE19E84017D7BA8EB59798F142132F79ECB7DACF6CE412CB50
                                                                                                                                                                                                                                                        Function 00007FF6D09E7F90 Relevance: 1.6, APIs: 1, Instructions: 85COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000001.00000002.2085594471.00007FF6D09E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D09E0000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000001.00000002.2085569640.00007FF6D09E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000001.00000002.2085629189.00007FF6D0A0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000001.00000002.2085658768.00007FF6D0A1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000001.00000002.2085658768.00007FF6D0A21000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000001.00000002.2085707438.00007FF6D0A24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_7ff6d09e0000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: _fread_nolock
                                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                                        • API String ID: 840049012-0
                                                                                                                                                                                                                                                        • Opcode ID: 09e0edd5bfc77bffd2ce204413b85077ed061b6568614956a0855b02b1706b89
                                                                                                                                                                                                                                                        • Instruction ID: 3d69f418cd18ee3511b5fbbee8e612212737a8d7e2ccf49ce56dac2ca010f38a
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 09e0edd5bfc77bffd2ce204413b85077ed061b6568614956a0855b02b1706b89
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 4A21E621B1A69166FA109A6265043FF9645FF85BD8F886432EE1CCF78BCE7DE465C300
                                                                                                                                                                                                                                                        Function 00007FF6D09FB93C Relevance: 1.6, APIs: 1, Instructions: 79COMMONLIBRARYCODE
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000001.00000002.2085594471.00007FF6D09E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D09E0000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000001.00000002.2085569640.00007FF6D09E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000001.00000002.2085629189.00007FF6D0A0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000001.00000002.2085658768.00007FF6D0A1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000001.00000002.2085658768.00007FF6D0A21000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000001.00000002.2085707438.00007FF6D0A24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_7ff6d09e0000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                                        • API String ID: 3215553584-0
                                                                                                                                                                                                                                                        • Opcode ID: c2d01373d3233558d420055387ebca2c39d1ce99b2c1a08127fa32cb0ba5fec2
                                                                                                                                                                                                                                                        • Instruction ID: fb763d096184f6096609c56f848b234e4a8721d18e35551d90ff92ee6913cb1f
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: c2d01373d3233558d420055387ebca2c39d1ce99b2c1a08127fa32cb0ba5fec2
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: AD316562A18602A5F7515F55844137C2E98BF80BACF562137FB1D8B3DBCEBCE4A18711
                                                                                                                                                                                                                                                        Function 00007FF6D09F5F94 Relevance: 1.6, APIs: 1, Instructions: 55COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000001.00000002.2085594471.00007FF6D09E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D09E0000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000001.00000002.2085569640.00007FF6D09E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000001.00000002.2085629189.00007FF6D0A0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000001.00000002.2085658768.00007FF6D0A1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000001.00000002.2085658768.00007FF6D0A21000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000001.00000002.2085707438.00007FF6D0A24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_7ff6d09e0000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                                        • API String ID: 3215553584-0
                                                                                                                                                                                                                                                        • Opcode ID: d0ecc1d4814c8292f6d285d86e9f4332b8d7141ecd04c52723bb65a1ba9d936a
                                                                                                                                                                                                                                                        • Instruction ID: 9e8442953db5231287fcba82469c70d4002c69b23ab76ef105012a4dc08d40ec
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: d0ecc1d4814c8292f6d285d86e9f4332b8d7141ecd04c52723bb65a1ba9d936a
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: EA117B31A1C64152EA609F51940027D6A68BF85B98F455433FB8CDFB9FCF7DD5604740
                                                                                                                                                                                                                                                        Function 00007FF6D0A06354 Relevance: 1.6, APIs: 1, Instructions: 54COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000001.00000002.2085594471.00007FF6D09E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D09E0000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000001.00000002.2085569640.00007FF6D09E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000001.00000002.2085629189.00007FF6D0A0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000001.00000002.2085658768.00007FF6D0A1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000001.00000002.2085658768.00007FF6D0A21000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000001.00000002.2085707438.00007FF6D0A24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_7ff6d09e0000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                                        • API String ID: 3215553584-0
                                                                                                                                                                                                                                                        • Opcode ID: 3765a10cee1e255344ee37f065f4be71d58868c9c9e645b3056c9746d3493235
                                                                                                                                                                                                                                                        • Instruction ID: 434e2f71a0c8881e63c46c6014e0400c33827d7d5b3eac8177101545670b31b0
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 3765a10cee1e255344ee37f065f4be71d58868c9c9e645b3056c9746d3493235
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 0A21AF33A1CA4696EB648F19D44137D76A0BB84B98F18423AE65DCB7DEDF3DD4218B00
                                                                                                                                                                                                                                                        Function 00007FF6D09F03BC Relevance: 1.5, APIs: 1, Instructions: 48COMMONLIBRARYCODE
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000001.00000002.2085594471.00007FF6D09E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D09E0000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000001.00000002.2085569640.00007FF6D09E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000001.00000002.2085629189.00007FF6D0A0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000001.00000002.2085658768.00007FF6D0A1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000001.00000002.2085658768.00007FF6D0A21000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000001.00000002.2085707438.00007FF6D0A24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_7ff6d09e0000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                                        • API String ID: 3215553584-0
                                                                                                                                                                                                                                                        • Opcode ID: 8e9754deeba93abb4745aa2efb451e77357aefa8fb0fbddb16feb6c8c90fdd62
                                                                                                                                                                                                                                                        • Instruction ID: 5325004799101a7b6e3388f10bea015e248ed98fc6802a3f9c7ecdb748000561
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 8e9754deeba93abb4745aa2efb451e77357aefa8fb0fbddb16feb6c8c90fdd62
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 4F018221A0874550E904DB5259000ADAA99AF85FE8F485632FF6C9BBEFDE3CD4214300
                                                                                                                                                                                                                                                        Function 00007FF6D09E8E80 Relevance: 1.5, APIs: 1, Instructions: 19libraryCOMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                          • Part of subcall function 00007FF6D09E9390: MultiByteToWideChar.KERNEL32(?,?,?,00007FF6D09E45F4,00000000,00007FF6D09E1985), ref: 00007FF6D09E93C9
                                                                                                                                                                                                                                                        • LoadLibraryExW.KERNEL32(?,00007FF6D09E6476,?,00007FF6D09E336E), ref: 00007FF6D09E8EA2
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000001.00000002.2085594471.00007FF6D09E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D09E0000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000001.00000002.2085569640.00007FF6D09E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000001.00000002.2085629189.00007FF6D0A0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000001.00000002.2085658768.00007FF6D0A1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000001.00000002.2085658768.00007FF6D0A21000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000001.00000002.2085707438.00007FF6D0A24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_7ff6d09e0000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: ByteCharLibraryLoadMultiWide
                                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                                        • API String ID: 2592636585-0
                                                                                                                                                                                                                                                        • Opcode ID: 3eee33850ff877a76f59ec51b6af72cd7d073a691558276a485592abc3036afa
                                                                                                                                                                                                                                                        • Instruction ID: 39177696b6e1259e9dc9199519993a6d4b587581c53f57d56c27a9f5c9ab4295
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 3eee33850ff877a76f59ec51b6af72cd7d073a691558276a485592abc3036afa
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 23D0C201F3924552EA48A77BBA4663E5251AF89BC4F88E037EE1D87B4FDC3CC0614B00
                                                                                                                                                                                                                                                        Function 00007FF6D09FD5FC Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        • HeapAlloc.KERNEL32(?,?,?,00007FF6D09F0C90,?,?,?,00007FF6D09F22FA,?,?,?,?,?,00007FF6D09F3AE9), ref: 00007FF6D09FD63A
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000001.00000002.2085594471.00007FF6D09E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D09E0000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000001.00000002.2085569640.00007FF6D09E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000001.00000002.2085629189.00007FF6D0A0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000001.00000002.2085658768.00007FF6D0A1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000001.00000002.2085658768.00007FF6D0A21000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000001.00000002.2085707438.00007FF6D0A24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_7ff6d09e0000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: AllocHeap
                                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                                        • API String ID: 4292702814-0
                                                                                                                                                                                                                                                        • Opcode ID: 510c613edcbd96140e332c46b5608733b20d975e117422ad796dc4540c81bb80
                                                                                                                                                                                                                                                        • Instruction ID: 6d0ff445d41f350033e12147ef29b67f42d042f3b87a66b90b452c3b07a2b65c
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 510c613edcbd96140e332c46b5608733b20d975e117422ad796dc4540c81bb80
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: E7F05E11F1E206A5FE645772580127C19994F857A8F182732FC2ECD3CBDD2CA4A08210

                                                                                                                                                                                                                                                        Non-executed Functions

                                                                                                                                                                                                                                                        Function 00007FF6D09E89E0 Relevance: 70.3, APIs: 36, Strings: 4, Instructions: 257synchronizationwindowregistryCOMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000001.00000002.2085594471.00007FF6D09E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D09E0000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000001.00000002.2085569640.00007FF6D09E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000001.00000002.2085629189.00007FF6D0A0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000001.00000002.2085658768.00007FF6D0A1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000001.00000002.2085658768.00007FF6D0A21000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000001.00000002.2085707438.00007FF6D0A24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_7ff6d09e0000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: Message$ErrorLast$ObjectProcessSingleWait$CloseCreateHandlePeekWindow_invalid_parameter_noinfo$ByteCharClassCodeCommandConsoleCtrlCurrentDestroyDispatchExitFormatHandlerInfoLineMultiRegisterStartupTerminateTranslateWide
                                                                                                                                                                                                                                                        • String ID: CreateProcessW$Failed to create child process!$PyInstaller Onefile Hidden Window$PyInstallerOnefileHiddenWindow
                                                                                                                                                                                                                                                        • API String ID: 3832162212-3165540532
                                                                                                                                                                                                                                                        • Opcode ID: 99838be411f58a84d89697932930ae4644c798f1dd42cd928399edbb9bf0e48e
                                                                                                                                                                                                                                                        • Instruction ID: 1c041c2bf00e6a7509045843fe90a2af158539d2eb8f2e2fdb29c652ec2e9437
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 99838be411f58a84d89697932930ae4644c798f1dd42cd928399edbb9bf0e48e
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: C5D1D132A19A86A6E7148F75E8502AE3760FF84758F141237DA5DC6BAECF3CD564C700
                                                                                                                                                                                                                                                        Function 00007FF6D09E81D0 Relevance: 24.6, APIs: 6, Strings: 8, Instructions: 117COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                          • Part of subcall function 00007FF6D09E9390: MultiByteToWideChar.KERNEL32(?,?,?,00007FF6D09E45F4,00000000,00007FF6D09E1985), ref: 00007FF6D09E93C9
                                                                                                                                                                                                                                                        • ExpandEnvironmentStringsW.KERNEL32(?,00007FF6D09E86B7,?,?,00000000,00007FF6D09E3CBB), ref: 00007FF6D09E822C
                                                                                                                                                                                                                                                          • Part of subcall function 00007FF6D09E2810: MessageBoxW.USER32 ref: 00007FF6D09E28EA
                                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000001.00000002.2085594471.00007FF6D09E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D09E0000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000001.00000002.2085569640.00007FF6D09E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000001.00000002.2085629189.00007FF6D0A0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000001.00000002.2085658768.00007FF6D0A1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000001.00000002.2085658768.00007FF6D0A21000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000001.00000002.2085707438.00007FF6D0A24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_7ff6d09e0000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: ByteCharEnvironmentExpandMessageMultiStringsWide
                                                                                                                                                                                                                                                        • String ID: %.*s$CreateDirectory$LOADER: failed to convert runtime-tmpdir to a wide string.$LOADER: failed to create runtime-tmpdir path %ls!$LOADER: failed to expand environment variables in the runtime-tmpdir.$LOADER: failed to obtain the absolute path of the runtime-tmpdir.$LOADER: runtime-tmpdir points to non-existent drive %ls (type: %d)!$\
                                                                                                                                                                                                                                                        • API String ID: 1662231829-930877121
                                                                                                                                                                                                                                                        • Opcode ID: 34679b23be2e6a85bad270fe565fa16c5e09c528fb77942a9d4832d630ea4d55
                                                                                                                                                                                                                                                        • Instruction ID: 9705a7f41a3778bbe20a72b0e9e0d87a4b2783617791c49f8b6f252c7d71e208
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 34679b23be2e6a85bad270fe565fa16c5e09c528fb77942a9d4832d630ea4d55
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 3251B922A2E64271FA549B65D9512BF6350FF44788F446433E61ECA7DFEE7CE8248300
                                                                                                                                                                                                                                                        Function 00007FF6D09E2180 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 120COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000001.00000002.2085594471.00007FF6D09E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D09E0000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000001.00000002.2085569640.00007FF6D09E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000001.00000002.2085629189.00007FF6D0A0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000001.00000002.2085658768.00007FF6D0A1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000001.00000002.2085658768.00007FF6D0A21000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000001.00000002.2085707438.00007FF6D0A24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_7ff6d09e0000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: MoveWindow$ObjectSelect$DrawReleaseText
                                                                                                                                                                                                                                                        • String ID: P%
                                                                                                                                                                                                                                                        • API String ID: 2147705588-2959514604
                                                                                                                                                                                                                                                        • Opcode ID: 044398bc2faddcfc72e28419b1c607044beef288ba0900b5e0371f537bcab75f
                                                                                                                                                                                                                                                        • Instruction ID: b1addf4061d0eb3cda5b0457c4acc114c4cd96d2f3579ae798734626181f88cc
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 044398bc2faddcfc72e28419b1c607044beef288ba0900b5e0371f537bcab75f
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: A05129266187A186D6389F22E4181BEB7A1F798B61F004132EFDE8379ADF3CD155CB10
                                                                                                                                                                                                                                                        Function 00007FF6D09EEA08 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 310COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000001.00000002.2085594471.00007FF6D09E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D09E0000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000001.00000002.2085569640.00007FF6D09E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000001.00000002.2085629189.00007FF6D0A0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000001.00000002.2085658768.00007FF6D0A1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000001.00000002.2085658768.00007FF6D0A21000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000001.00000002.2085707438.00007FF6D0A24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_7ff6d09e0000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
                                                                                                                                                                                                                                                        • String ID: csm$csm$csm
                                                                                                                                                                                                                                                        • API String ID: 849930591-393685449
                                                                                                                                                                                                                                                        • Opcode ID: aab7c7e636ea8a2572919ef13f94062ff4905efd63cd4babadd9079b892b9703
                                                                                                                                                                                                                                                        • Instruction ID: 7fa0935ef7fd96ed2e520c11019f7cf75e732627331a2ae481c8b77e65ed6183
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: aab7c7e636ea8a2572919ef13f94062ff4905efd63cd4babadd9079b892b9703
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 6AD17F32A0974196EB209B65D4403AD77A0FB4578CF142136EE8DDBB9BDF38E8A5C740
                                                                                                                                                                                                                                                        Function 00007FF6D09FB150 Relevance: 10.6, APIs: 7, Instructions: 62COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000001.00000002.2085594471.00007FF6D09E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D09E0000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000001.00000002.2085569640.00007FF6D09E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000001.00000002.2085629189.00007FF6D0A0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000001.00000002.2085658768.00007FF6D0A1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000001.00000002.2085658768.00007FF6D0A21000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000001.00000002.2085707438.00007FF6D0A24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_7ff6d09e0000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: Value$ErrorLast
                                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                                        • API String ID: 2506987500-0
                                                                                                                                                                                                                                                        • Opcode ID: bd40692f84e3da01acd5c9e715af8932c2ff4b5b564443a413d720313231dc09
                                                                                                                                                                                                                                                        • Instruction ID: 15fcbea05dcd9f4d7a8612b5dcccbe4772ff1cbbe8b4a1dd11fc4a22a4dd6d21
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: bd40692f84e3da01acd5c9e715af8932c2ff4b5b564443a413d720313231dc09
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 10217F61B0C64271FA589722966517D194A5F447B8F186736FA3ECA7CFDD2CB4604301
                                                                                                                                                                                                                                                        Function 00007FF6D09FB224 Relevance: 7.6, APIs: 5, Instructions: 50COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000001.00000002.2085594471.00007FF6D09E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D09E0000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000001.00000002.2085569640.00007FF6D09E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000001.00000002.2085629189.00007FF6D0A0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000001.00000002.2085658768.00007FF6D0A1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000001.00000002.2085658768.00007FF6D0A21000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000001.00000002.2085707438.00007FF6D0A24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_7ff6d09e0000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: Value
                                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                                        • API String ID: 3702945584-0
                                                                                                                                                                                                                                                        • Opcode ID: cf61fb6c00b1796c5bed08ecf7b6551a73a14dc995a044f45feadad5ae41d3ad
                                                                                                                                                                                                                                                        • Instruction ID: 3963ebe4b975e9383235a0ebb2bb431550efa829053cfd9e1ac6d31604d4631e
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: cf61fb6c00b1796c5bed08ecf7b6551a73a14dc995a044f45feadad5ae41d3ad
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 551118A0E0860771F958A76244611BD194A5FA533CF18A736FA3ECE7DFDD2CB8604201
                                                                                                                                                                                                                                                        Function 00007FF6D09FF98C Relevance: 6.2, APIs: 4, Instructions: 162COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000001.00000002.2085594471.00007FF6D09E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D09E0000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000001.00000002.2085569640.00007FF6D09E0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000001.00000002.2085629189.00007FF6D0A0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000001.00000002.2085658768.00007FF6D0A1E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000001.00000002.2085658768.00007FF6D0A21000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000001.00000002.2085707438.00007FF6D0A24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_7ff6d09e0000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: _get_daylight$_isindst
                                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                                        • API String ID: 4170891091-0
                                                                                                                                                                                                                                                        • Opcode ID: 873197461a12b50781dd6dd2a54ab0b7f590f407db75148e336b6c99fa373a01
                                                                                                                                                                                                                                                        • Instruction ID: 576ccc30c3309e7820e50b6d768e5ed48d0bd775ca8cc0cf793c7e93b20b9a58
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 873197461a12b50781dd6dd2a54ab0b7f590f407db75148e336b6c99fa373a01
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: A751F773F0411196EB18CF65D9616BC2B69AF4435DF501236ED1D9ABDEDF3CA4128700