Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
wp-s2.exe

Overview

General Information

Sample name:wp-s2.exe
Analysis ID:1578736
MD5:62370a84134040d803eae9a4bd34342c
SHA1:207f73ffdcdfa2cb5d713e13385a8c65bb19adf7
SHA256:e84a1edd3826ccb96eadc6d62410361e7820f3c5bc8b7ba308278f33aa2266e4
Tags:exeuser-smica83
Infos:

Detection

Python BackDoor
Score:68
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Multi AV Scanner detection for submitted file
Yara detected Python BackDoor
AI detected suspicious sample
Opens network shares
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Binary contains a suspicious time stamp
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to query CPU information (cpuid)
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Drops PE files
Enables debug privileges
Extensive use of GetProcAddress (often used to hide API calls)
Found dropped PE file which has not been started or loaded
Found evasive API chain checking for process token information
Found potential string decryption / allocating functions
IP address seen in connection with other malware
One or more processes crash
PE file contains executable resources (Code or Archives)
PE file contains sections with non-standard names
PE file does not import any functions
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info

Classification

Process Tree

  • System is w10x64
  • wp-s2.exe (PID: 7256 cmdline: "C:\Users\user\Desktop\wp-s2.exe" MD5: 62370A84134040D803EAE9A4BD34342C)
    • wp-s2.exe (PID: 7308 cmdline: "C:\Users\user\Desktop\wp-s2.exe" MD5: 62370A84134040D803EAE9A4BD34342C)
      • systeminfo.exe (PID: 7480 cmdline: systeminfo MD5: EE309A9C61511E907D87B10EF226FDCD)
        • conhost.exe (PID: 7492 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • WmiPrvSE.exe (PID: 7596 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)
      • cmd.exe (PID: 7704 cmdline: C:\Windows\system32\cmd.exe /c "wmic computersystem get manufacturer" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 7724 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • WMIC.exe (PID: 7772 cmdline: wmic computersystem get manufacturer MD5: C37F2F4F4B3CD128BDABCAEB2266A785)
      • WerFault.exe (PID: 7928 cmdline: C:\Windows\system32\WerFault.exe -u -p 7308 -s 984 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000001.00000003.1813063325.000001F10684D000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_PythonBackDoor_1Yara detected Python BackDoorJoe Security
    00000001.00000003.1813329985.000001F10682F000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_PythonBackDoor_1Yara detected Python BackDoorJoe Security
      00000001.00000002.2480246518.000001F10682F000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_PythonBackDoor_1Yara detected Python BackDoorJoe Security
        Process Memory Space: wp-s2.exe PID: 7308JoeSecurity_PythonBackDoor_1Yara detected Python BackDoorJoe Security

          Sigma Signatures

          ⊘No Sigma rule has matched

          Suricata Signatures

          ⊘No Suricata rule has matched

          Joe Sandbox Signatures

          Click to jump to signature section

          Show All Signature Results

          AV Detection

          barindex
          Multi AV Scanner detection for submitted file
          Source: wp-s2.exeVirustotal: Detection: 8%Perma Link
          AI detected suspicious sample
          Source: Submited SampleIntegrated Neural Analysis Model: Matched 99.6% probability
          Source: wp-s2.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
          Source: Binary string: C:\Users\qt\work\qt\qtsvg\plugins\imageformats\qsvg.pdb source: wp-s2.exe, 00000000.00000003.1771222145.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp
          Source: Binary string: C:\Users\qt\work\qt\qtsvg\plugins\iconengines\qsvgicon.pdb source: wp-s2.exe, 00000000.00000003.1770599441.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp
          Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\generic\qtuiotouchplugin.pdb source: wp-s2.exe, 00000000.00000003.1770445463.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp
          Source: Binary string: d:\agent\_work\1\s\\binaries\amd64ret\bin\amd64\\msvcp140.amd64.pdb source: wp-s2.exe, 00000001.00000002.2494414791.00007FFE01345000.00000002.00000001.01000000.0000000D.sdmp
          Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\imageformats\qico.pdb source: wp-s2.exe, 00000000.00000003.1770880558.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp
          Source: Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG"OpenSSL 3.0.15 3 Sep 20243.0.15built on: Wed Sep 4 15:52:04 2024 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-3"MODULESDIR: "C:\Program Files\OpenSSL\lib\ossl-modules"CPUINFO: N/Anot availableget_and_lock..\s\crypto\ex_data.cossl_crypto_get_ex_new_index_exossl_crypto_new_ex_data_exCRYPTO_dup_ex_dataCRYPTO_set_ex_dataOPENSSL_WIN32_UTF8..\s\crypto\getenv.ccompiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG";CPUINFO: OPENSSL_ia32cap=0x%llx:0x%llxOPENSSL_ia32cap env:%sos-specificC:\Program Files\Common Files\SSLC:\Program Files\OpenSSL\lib\ossl-modules.dllCPUINFO: ..\s\crypto\init.cOPENSSL_init_cryptoOPENSSL_atexit..\s\crypto\initthread.c..\s\crypto\mem_sec.cassertion failed: (bit & 1) == 0assertion failed: list >= 0 && list < sh.freelist_sizeassertion failed: ((ptr - sh.arena) & ((sh.arena_size >> list) - 1)) == 0assertion failed: bit > 0 && bit < sh.bittable_sizeassertion failed: TESTBIT(table, bit)assertion failed: !TESTBIT(table, bit)assertion failed: WITHIN_FREELIST(list)assertion failed: WITHIN_ARENA(ptr)assertion failed: temp->next == NULL || WITHIN_ARENA(temp->next)assertion failed: (char **)temp->next->p_next == listassertion failed: WITHIN_FREELIST(temp2->p_next) || WITHIN_ARENA(temp2->p_next)assertion failed: size > 0assertion failed: (size & (size - 1)) == 0assertion failed: (minsize & (minsize - 1)) == 0assertion failed: sh.freelist != NULLassertion failed: sh.bittable != NULLassertion failed: sh.bitmalloc != NULLassertion failed: !sh_testbit(temp, slist, sh.bitmalloc)assertion failed: temp != sh.freelist[slist]assertion failed: sh.freelist[slist] == tempassertion failed: temp-(sh.arena_size >> slist) == sh_find_my_buddy(temp, slist)assertion failed: sh_testbit(chunk, list, sh.bittable)assertion failed: WITHIN_ARENA(chunk)assertion failed: sh_testbit(ptr, list, sh.bittable)assertion failed: ptr == sh_find_my_buddy(buddy, list)assertion failed: ptr != NULLassertion failed: !sh_testbit(ptr, list, sh.bitmalloc)assertion failed: sh.freelist[list] == ptr/*0123456789ABCDEFCRYPTO_memdup..\s\crypto\o_str.chexstr2buf_sepossl_hexstr2buf_sepbuf2hexstr_sepossl_buf2hexstr_sep..\s\crypto\packet.cwpacket_intern_init_lenWPACKET_start_sub_packet_len__..\s\crypto\param_build.cparam_pushparam_push_numOSSL_PARAM_BLD_push_BN_padNegative big numbers are unsupported for OSSL_PARAMOSSL_PARAM_BLD_push_utf8_stringOSSL_PARAM_BLD_push_utf8_ptrOSSL_PARAM_BLD_push_octet_stringOSSL_PARAM_BLD_p
          Source: Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG" source: wp-s2.exe, 00000001.00000002.2490060691.00007FFDFAAE2000.00000002.00000001.01000000.00000014.sdmp
          Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdbGCTL source: wp-s2.exe, 00000000.00000003.1796815557.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2501028309.00007FFE11EE4000.00000002.00000001.01000000.00000005.sdmp
          Source: Binary string: d:\agent\_work\1\s\\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdb source: wp-s2.exe, 00000000.00000003.1750997076.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2501288886.00007FFE12E15000.00000002.00000001.01000000.0000000F.sdmp
          Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdb source: wp-s2.exe, 00000000.00000003.1796955936.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp
          Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\styles\qwindowsvistastyle.pdb%% source: wp-s2.exe, 00000001.00000002.2496721995.00007FFE0CFD7000.00000002.00000001.01000000.00000021.sdmp
          Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\styles\qwindowsvistastyle.pdb source: wp-s2.exe, 00000001.00000002.2496721995.00007FFE0CFD7000.00000002.00000001.01000000.00000021.sdmp
          Source: Binary string: D:\a\1\b\bin\amd64\_ctypes.pdb source: wp-s2.exe, 00000001.00000002.2500894120.00007FFE11EB3000.00000002.00000001.01000000.00000007.sdmp
          Source: Binary string: C:\Users\qt\work\qt\qtimageformats\plugins\imageformats\qwebp.pdb source: qwebp.dll.0.dr
          Source: Binary string: D:\a\1\b\bin\amd64\_hashlib.pdb source: wp-s2.exe, 00000000.00000003.1797514749.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2500754905.00007FFE11BB6000.00000002.00000001.01000000.00000016.sdmp
          Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\imageformats\qico.pdb source: wp-s2.exe, 00000000.00000003.1770880558.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp
          Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\generic\qtuiotouchplugin.pdb source: wp-s2.exe, 00000000.00000003.1770445463.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp
          Source: Binary string: C:\Users\qt\work\qt\qtbase\lib\Qt5Core.pdbT source: wp-s2.exe, 00000001.00000002.2490662547.00007FFDFB0B6000.00000002.00000001.01000000.0000000C.sdmp
          Source: Binary string: C:\Users\qt\work\qt\qtbase\lib\Qt5Gui.pdb source: wp-s2.exe, 00000001.00000002.2486560927.00007FFDF96FA000.00000002.00000001.01000000.0000001E.sdmp
          Source: Binary string: D:\a\1\b\bin\amd64\_lzma.pdb source: wp-s2.exe, 00000000.00000003.1797719666.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2499967095.00007FFE1025B000.00000002.00000001.01000000.0000000A.sdmp
          Source: Binary string: D:\a\1\b\bin\amd64\_bz2.pdb source: wp-s2.exe, 00000000.00000003.1797066409.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2500504438.00007FFE1151D000.00000002.00000001.01000000.00000009.sdmp
          Source: Binary string: D:\a\1\b\bin\amd64\_socket.pdb source: wp-s2.exe, 00000000.00000003.1797956860.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2500189217.00007FFE10309000.00000002.00000001.01000000.00000011.sdmp
          Source: Binary string: D:\a\1\b\bin\amd64\python313.pdb source: wp-s2.exe, 00000001.00000002.2492067322.00007FFDFB888000.00000002.00000001.01000000.00000004.sdmp
          Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdbGCTL source: wp-s2.exe, 00000000.00000003.1796955936.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp
          Source: Binary string: d:\agent\_work\1\s\\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: wp-s2.exe, 00000000.00000003.1750785868.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp
          Source: Binary string: C:\Users\qt\work\qt\qtimageformats\plugins\imageformats\qtiff.pdbBB source: wp-s2.exe, 00000000.00000003.1771468917.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp
          Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\platformthemes\qxdgdesktopportal.pdb source: wp-s2.exe, 00000000.00000003.1774242555.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp
          Source: Binary string: D:\a\1\b\bin\amd64\unicodedata.pdb source: wp-s2.exe, 00000000.00000003.1804628337.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2489048458.00007FFDFA727000.00000002.00000001.01000000.0000001A.sdmp
          Source: Binary string: d:\agent\_work\1\s\\binaries\amd64ret\bin\amd64\\msvcp140_1.amd64.pdb source: wp-s2.exe, 00000000.00000003.1735753907.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2501431755.00007FFE130C3000.00000002.00000001.01000000.0000000E.sdmp
          Source: Binary string: D:\a\1\b\libcrypto-3.pdb| source: wp-s2.exe, 00000001.00000002.2490060691.00007FFDFAB7A000.00000002.00000001.01000000.00000014.sdmp
          Source: Binary string: D:\a\1\b\libssl-3.pdbDD source: wp-s2.exe, 00000001.00000002.2493837797.00007FFE00525000.00000002.00000001.01000000.00000015.sdmp
          Source: Binary string: C:\Users\qt\work\qt\qtbase\lib\Qt5Core.pdb source: wp-s2.exe, 00000001.00000002.2490662547.00007FFDFB0B6000.00000002.00000001.01000000.0000000C.sdmp
          Source: Binary string: C:\Users\qt\work\qt\qtimageformats\plugins\imageformats\qtiff.pdb source: wp-s2.exe, 00000000.00000003.1771468917.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp
          Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\imageformats\qgif.pdb source: wp-s2.exe, 00000000.00000003.1770697607.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp
          Source: Binary string: D:\a\1\b\bin\amd64\_wmi.pdb(('GCTL source: wp-s2.exe, 00000000.00000003.1798245398.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp
          Source: Binary string: C:\Users\qt\work\qt\qtimageformats\plugins\imageformats\qtga.pdb source: wp-s2.exe, 00000000.00000003.1771324699.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp
          Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: wp-s2.exe, 00000000.00000003.1796815557.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2501028309.00007FFE11EE4000.00000002.00000001.01000000.00000005.sdmp
          Source: Binary string: D:\a\1\b\libcrypto-3.pdb source: wp-s2.exe, 00000001.00000002.2490060691.00007FFDFAB7A000.00000002.00000001.01000000.00000014.sdmp
          Source: Binary string: C:\Users\qt\work\qt\qtimageformats\plugins\imageformats\qicns.pdb source: wp-s2.exe, 00000000.00000003.1770788946.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp
          Source: Binary string: D:\a\1\b\bin\amd64\select.pdb source: wp-s2.exe, 00000000.00000003.1804322866.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2501157443.00007FFE120C3000.00000002.00000001.01000000.00000012.sdmp
          Source: Binary string: D:\a\1\b\bin\amd64\_lzma.pdbNN source: wp-s2.exe, 00000000.00000003.1797719666.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2499967095.00007FFE1025B000.00000002.00000001.01000000.0000000A.sdmp
          Source: Binary string: D:\a\1\b\bin\amd64\_queue.pdb source: wp-s2.exe, 00000000.00000003.1797860226.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2500630743.00007FFE117E3000.00000002.00000001.01000000.00000017.sdmp
          Source: Binary string: D:\a\1\b\bin\amd64\_wmi.pdb source: wp-s2.exe, 00000000.00000003.1798245398.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp
          Source: Binary string: C:\Users\qt\work\qt\qtbase\lib\Qt5Widgets.pdb source: wp-s2.exe, 00000001.00000002.2487611150.00007FFDF9CFA000.00000002.00000001.01000000.0000001D.sdmp
          Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\platforms\qwindows.pdb source: wp-s2.exe, 00000001.00000002.2484669834.00007FFDF9014000.00000002.00000001.01000000.00000020.sdmp
          Source: Binary string: C:\Users\qt\work\qt\qtimageformats\plugins\imageformats\qwbmp.pdb source: wp-s2.exe, 00000000.00000003.1771729138.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp
          Source: Binary string: D:\a\1\b\bin\amd64\python3.pdb source: wp-s2.exe, 00000000.00000003.1802046701.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2479910791.000001F106200000.00000002.00000001.01000000.00000006.sdmp
          Source: Binary string: C:\Users\qt\work\qt\qtbase\lib\libEGL.pdb source: wp-s2.exe, 00000000.00000003.1753345379.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp
          Source: Binary string: D:\a\1\b\libssl-3.pdb source: wp-s2.exe, 00000001.00000002.2493837797.00007FFE00525000.00000002.00000001.01000000.00000015.sdmp
          Source: Binary string: D:\a\1\b\bin\amd64\_ssl.pdb source: wp-s2.exe, 00000001.00000002.2498543448.00007FFE0E16E000.00000002.00000001.01000000.00000013.sdmp
          Source: C:\Users\user\Desktop\wp-s2.exeCode function: 0_2_00007FF705679280 FindFirstFileExW,FindClose,0_2_00007FF705679280
          Source: C:\Users\user\Desktop\wp-s2.exeCode function: 0_2_00007FF7056783C0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,0_2_00007FF7056783C0
          Source: C:\Users\user\Desktop\wp-s2.exeCode function: 0_2_00007FF705691874 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,0_2_00007FF705691874
          Source: C:\Windows\System32\WerFault.exeFile opened: C:\Users\user\AppData\Local\Temp\_MEI72562\Jump to behavior
          Source: C:\Windows\System32\WerFault.exeFile opened: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\plugins\platforms\Jump to behavior
          Source: C:\Windows\System32\WerFault.exeFile opened: C:\Users\user\AppData\Local\Jump to behavior
          Source: C:\Windows\System32\WerFault.exeFile opened: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\Jump to behavior
          Source: C:\Windows\System32\WerFault.exeFile opened: C:\Users\user\AppData\Jump to behavior
          Source: C:\Windows\System32\WerFault.exeFile opened: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Jump to behavior
          Source: Joe Sandbox ViewIP Address: 104.20.22.46 104.20.22.46
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: global trafficDNS traffic detected: DNS query: nodejs.org
          Source: wp-s2.exe, 00000001.00000002.2481492331.000001F107210000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://.../back.jpeg
          Source: wp-s2.exe, 00000000.00000003.1804628337.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1798102603.0000025ADA794000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digi
          Source: wp-s2.exe, 00000000.00000003.1753345379.0000025ADA793000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredID
          Source: wp-s2.exe, 00000000.00000003.1774242555.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1748090007.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1771882919.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1773568388.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1770788946.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1771324699.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1753345379.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1770998747.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1737563531.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1771222145.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1743696412.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1744734720.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1771468917.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1772302388.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1742837267.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1770445463.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1736316426.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1745491092.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1770599441.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1754535612.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1771222145.0000025ADA7A0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
          Source: wp-s2.exe, 00000000.00000003.1797719666.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1804322866.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1804322866.0000025ADA7A1000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1797066409.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1797956860.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1797860226.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1797347247.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1797196384.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1804628337.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1799781234.0000025ADA7A1000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1797514749.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1799781234.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1800796890.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1798102603.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1798245398.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1800969984.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1802046701.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1802782587.0000025ADA794000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
          Source: wp-s2.exe, 00000000.00000003.1774242555.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1748090007.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1771882919.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1773568388.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1770788946.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1771324699.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1753345379.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1770998747.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1737563531.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1771222145.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1743696412.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1744734720.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1771468917.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1772302388.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1742837267.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1770445463.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1736316426.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1745491092.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1770599441.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1754535612.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1770697607.0000025ADA793000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
          Source: wp-s2.exe, 00000000.00000003.1774242555.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1748090007.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1771882919.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1773568388.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1770788946.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1771324699.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1753345379.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1770998747.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1737563531.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1771222145.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1743696412.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1744734720.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1771468917.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1772302388.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1742837267.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1770445463.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1736316426.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1745491092.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1770599441.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1754535612.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1771222145.0000025ADA7A0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
          Source: wp-s2.exe, 00000000.00000003.1797719666.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1804322866.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1797066409.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1797956860.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1797860226.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1797347247.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1797196384.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1804628337.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1799781234.0000025ADA7A1000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1799781234.0000025ADA79B000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1797514749.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1800796890.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1798102603.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1798245398.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1800969984.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1802046701.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1802782587.0000025ADA794000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
          Source: wp-s2.exe, 00000000.00000003.1797719666.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1804322866.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1797066409.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1797956860.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1797860226.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1797347247.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1797196384.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1804628337.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1797514749.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1799781234.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1800796890.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1798102603.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1798245398.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1800969984.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1802046701.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1802782587.0000025ADA794000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
          Source: wp-s2.exe, 00000000.00000003.1797719666.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1804322866.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1804322866.0000025ADA7A1000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1797066409.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1797956860.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1797860226.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1797347247.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1797196384.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1804628337.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1799781234.0000025ADA79B000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1797514749.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1799781234.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1800796890.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1798102603.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1798245398.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1800969984.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1802046701.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1802782587.0000025ADA794000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
          Source: wp-s2.exe, 00000001.00000003.1834949666.000001F106D47000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2480794041.000001F106D47000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://code.activestate.com/recipes/577452-a-memoize-decorator-for-instance-methods/
          Source: wp-s2.exe, 00000001.00000003.1835840263.000001F106F68000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2480794041.000001F106F68000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.certigna.fr/certignarootca.crl01
          Source: wp-s2.exe, 00000001.00000002.2480050225.000001F106396000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1834949666.000001F106D47000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2480794041.000001F106D47000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
          Source: wp-s2.exe, 00000001.00000003.1834949666.000001F106DDB000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2480794041.000001F106D2B000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1834949666.000001F106D2B000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2480794041.000001F106DA2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.comodoca.com/COMODOCertificationAuthority.crl
          Source: wp-s2.exe, 00000001.00000003.1835840263.000001F106F68000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2480794041.000001F106F68000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.dhimyotis.com/certignarootca.crl
          Source: wp-s2.exe, 00000001.00000002.2480050225.000001F106396000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.securetrust.com/SGCA.crl
          Source: wp-s2.exe, 00000001.00000002.2480794041.000001F106BC0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.securetrust.com/SGCA.crl0
          Source: wp-s2.exe, 00000001.00000002.2480050225.000001F106396000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.securetrust.com/STCA.crl
          Source: wp-s2.exe, 00000001.00000002.2480794041.000001F106BC0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.securetrust.com/STCA.crl0
          Source: wp-s2.exe, 00000001.00000002.2480050225.000001F106396000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl
          Source: wp-s2.exe, 00000001.00000003.1834949666.000001F106D47000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2480794041.000001F106D47000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl0
          Source: wp-s2.exe, 00000000.00000003.1797719666.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1804322866.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1804322866.0000025ADA7A1000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1797066409.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1797956860.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1797860226.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1797347247.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1797196384.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1804628337.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1799781234.0000025ADA7A1000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1797514749.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1799781234.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1800796890.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1798102603.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1798245398.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1800969984.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1802046701.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1802782587.0000025ADA794000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
          Source: wp-s2.exe, 00000000.00000003.1774242555.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1748090007.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1771882919.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1773568388.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1770788946.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1771324699.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1753345379.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1770998747.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1737563531.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1771222145.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1743696412.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1744734720.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1771468917.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1772302388.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1742837267.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1770445463.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1736316426.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1745491092.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1770599441.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1754535612.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1770697607.0000025ADA793000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
          Source: wp-s2.exe, 00000000.00000003.1774242555.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1748090007.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1771882919.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1773568388.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1770788946.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1771324699.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1753345379.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1770998747.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1737563531.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1771222145.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1743696412.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1744734720.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1771468917.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1772302388.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1742837267.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1770445463.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1736316426.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1745491092.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1770599441.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1754535612.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1771222145.0000025ADA7A0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
          Source: wp-s2.exe, 00000000.00000003.1797719666.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1804322866.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1797066409.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1797956860.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1797860226.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1797347247.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1797196384.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1804628337.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1799781234.0000025ADA7A1000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1799781234.0000025ADA79B000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1797514749.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1800796890.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1798102603.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1798245398.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1800969984.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1802046701.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1802782587.0000025ADA794000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
          Source: wp-s2.exe, 00000000.00000003.1797719666.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1804322866.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1797066409.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1797956860.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1797860226.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1797347247.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1797196384.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1804628337.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1797514749.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1799781234.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1800796890.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1798102603.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1798245398.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1800969984.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1802046701.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1802782587.0000025ADA794000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
          Source: wp-s2.exe, 00000000.00000003.1802782587.0000025ADA794000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
          Source: wp-s2.exe, 00000000.00000003.1774242555.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1748090007.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1771882919.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1773568388.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1770788946.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1771324699.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1753345379.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1770998747.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1737563531.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1771222145.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1743696412.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1744734720.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1771468917.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1772302388.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1742837267.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1770445463.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1736316426.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1745491092.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1770599441.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1754535612.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1770697607.0000025ADA793000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
          Source: wp-s2.exe, 00000000.00000003.1771882919.0000025ADA793000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl
          Source: wp-s2.exe, 00000000.00000003.1774242555.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1748090007.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1771882919.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1773568388.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1770788946.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1771324699.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1753345379.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1770998747.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1737563531.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1771222145.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1743696412.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1744734720.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1771468917.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1772302388.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1742837267.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1770445463.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1736316426.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1745491092.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1770599441.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1754535612.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1771222145.0000025ADA7A0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
          Source: wp-s2.exe, 00000000.00000003.1774242555.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1748090007.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1771882919.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1773568388.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1770788946.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1771324699.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1753345379.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1770998747.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1737563531.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1771222145.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1743696412.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1744734720.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1771468917.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1772302388.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1742837267.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1770445463.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1736316426.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1745491092.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1770599441.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1754535612.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1771222145.0000025ADA7A0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
          Source: wp-s2.exe, 00000000.00000003.1797719666.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1804322866.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1797066409.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1797956860.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1797860226.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1797347247.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1797196384.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1804628337.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1799781234.0000025ADA7A1000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1799781234.0000025ADA79B000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1797514749.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1800796890.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1798102603.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1798245398.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1800969984.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1802046701.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1802782587.0000025ADA794000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
          Source: wp-s2.exe, 00000000.00000003.1774242555.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1748090007.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1771882919.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1773568388.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1770788946.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1771324699.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1753345379.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1770998747.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1737563531.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1771222145.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1743696412.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1744734720.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1771468917.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1772302388.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1742837267.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1770445463.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1736316426.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1745491092.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1770599441.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1754535612.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1770697607.0000025ADA793000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0L
          Source: wp-s2.exe, 00000000.00000003.1774242555.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1748090007.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1771882919.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1773568388.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1770788946.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1771324699.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1753345379.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1770998747.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1737563531.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1771222145.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1743696412.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1744734720.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1771468917.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1772302388.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1742837267.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1770445463.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1736316426.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1745491092.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1770599441.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1754535612.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1771222145.0000025ADA7A0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
          Source: wp-s2.exe, 00000001.00000002.2481492331.000001F107210000.00000004.00001000.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1818662555.000001F106E28000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://curl.haxx.se/rfc/cookie_spec.html
          Source: wp-s2.exe, 00000001.00000002.2481707364.000001F107400000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://goo.gl/zeJZl.
          Source: wp-s2.exe, 00000001.00000002.2480794041.000001F106CD0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://google.com/
          Source: wp-s2.exe, 00000001.00000002.2480794041.000001F106BC0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://google.com/mail/
          Source: wp-s2.exe, 00000001.00000003.1834949666.000001F106CD5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2480794041.000001F106CD0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://hg.python.org/cpython/file/603b4d593758/Lib/socket.py#l535
          Source: wp-s2.exe, 00000001.00000002.2481492331.000001F107210000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://mail.python.org/pipermail/python-dev/2012-June/120787.html.
          Source: wp-s2.exe, 00000001.00000002.2480794041.000001F106EE4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1833751555.000001F106F0F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.accv.es
          Source: wp-s2.exe, 00000001.00000003.1835840263.000001F106F68000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2480794041.000001F106F68000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.accv.es0
          Source: wp-s2.exe, 00000001.00000002.2480794041.000001F106EE4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1833751555.000001F106F0F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.accv.esMa~
          Source: wp-s2.exe, 00000000.00000003.1797719666.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1804322866.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1797066409.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1797956860.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1797860226.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1797347247.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1797196384.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1804628337.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1799781234.0000025ADA7A1000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1799781234.0000025ADA79B000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1797514749.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1800796890.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1798102603.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1798245398.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1800969984.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1802046701.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1802782587.0000025ADA794000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0
          Source: wp-s2.exe, 00000000.00000003.1797719666.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1804322866.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1804322866.0000025ADA7A1000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1797066409.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1797956860.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1797860226.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1797347247.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1797196384.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1804628337.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1799781234.0000025ADA79B000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1797514749.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1799781234.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1800796890.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1798102603.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1798245398.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1800969984.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1802046701.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1802782587.0000025ADA794000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0A
          Source: wp-s2.exe, 00000000.00000003.1774242555.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1748090007.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1771882919.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1773568388.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1797719666.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1770788946.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1771324699.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1804322866.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1804322866.0000025ADA7A1000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1797066409.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1753345379.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1797956860.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1770998747.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1737563531.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1771222145.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1743696412.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1797860226.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1797347247.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1744734720.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1797196384.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1771468917.0000025ADA793000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0C
          Source: wp-s2.exe, 00000000.00000003.1774242555.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1748090007.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1771882919.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1773568388.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1770788946.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1771324699.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1753345379.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1770998747.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1737563531.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1771222145.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1743696412.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1744734720.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1771468917.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1772302388.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1742837267.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1770445463.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1736316426.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1745491092.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1770599441.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1754535612.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1770697607.0000025ADA793000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0N
          Source: wp-s2.exe, 00000000.00000003.1774242555.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1748090007.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1771882919.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1773568388.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1770788946.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1771324699.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1753345379.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1770998747.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1737563531.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1771222145.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1743696412.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1744734720.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1771468917.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1772302388.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1742837267.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1770445463.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1736316426.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1745491092.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1770599441.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1754535612.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1771222145.0000025ADA7A0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0O
          Source: wp-s2.exe, 00000000.00000003.1797719666.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1804322866.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1797066409.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1797956860.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1797860226.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1797347247.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1797196384.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1804628337.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1797514749.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1799781234.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1800796890.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1798102603.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1798245398.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1800969984.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1802046701.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1802782587.0000025ADA794000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0X
          Source: wp-s2.exe, 00000001.00000002.2480794041.000001F106EE4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1833751555.000001F106F0F000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2480794041.000001F106D2B000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1834949666.000001F106D2B000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2480794041.000001F106DA2000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1834949666.000001F106DA4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://repository.swisssign.com/
          Source: wp-s2.exe, 00000001.00000002.2480794041.000001F106EE4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1833751555.000001F106F0F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://repository.swisssign.com/h:
          Source: wp-s2.exe, 00000001.00000002.2481413192.000001F1070E0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://tools.ietf.org/html/rfc6125#section-6.4.3
          Source: wp-s2.exe, 00000001.00000002.2480794041.000001F106EE4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1835840263.000001F106F68000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1833751555.000001F106F0F000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2480794041.000001F106F68000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1.crt0
          Source: wp-s2.exe, 00000001.00000002.2480794041.000001F106EE4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1833751555.000001F106F0F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl
          Source: wp-s2.exe, 00000001.00000003.1835840263.000001F106F68000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2480794041.000001F106F68000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl0
          Source: wp-s2.exe, 00000001.00000002.2480794041.000001F106EE4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1833751555.000001F106F0F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crlaT
          Source: wp-s2.exe, 00000001.00000002.2480794041.000001F106EE4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1833751555.000001F106F0F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.accv.es/legislacion_c.htm
          Source: wp-s2.exe, 00000001.00000003.1835840263.000001F106F68000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2480794041.000001F106F68000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.accv.es/legislacion_c.htm0U
          Source: wp-s2.exe, 00000001.00000002.2480794041.000001F106EE4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1835840263.000001F106F68000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1833751555.000001F106F0F000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2480794041.000001F106F68000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.accv.es00
          Source: wp-s2.exe, 00000001.00000002.2486560927.00007FFDF96FA000.00000002.00000001.01000000.0000001E.sdmpString found in binary or memory: http://www.aiim.org/pdfa/ns/id/
          Source: wp-s2.exe, 00000001.00000003.1835840263.000001F106F68000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2480794041.000001F106F68000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.cert.fnmt.es/dpcs/
          Source: wp-s2.exe, 00000001.00000002.2480050225.000001F106396000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.cert.fnmt.es/dpcs/0
          Source: wp-s2.exe, 00000001.00000002.2480794041.000001F106BC0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.cert.fnmt.es/dpcs/:
          Source: wp-s2.exe, 00000001.00000003.1835840263.000001F106F68000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2480794041.000001F106F68000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.cert.fnmt.es/dpcs/n
          Source: wp-s2.exe, 00000001.00000002.2486560927.00007FFDF96FA000.00000002.00000001.01000000.0000001E.sdmpString found in binary or memory: http://www.color.org)
          Source: wp-s2.exe, 00000000.00000003.1797719666.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1804322866.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1797066409.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1797956860.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1797860226.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1797347247.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1797196384.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1804628337.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1799781234.0000025ADA7A1000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1799781234.0000025ADA79B000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1797514749.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1800796890.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1798102603.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1798245398.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1800969984.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1802046701.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1802782587.0000025ADA794000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.digicert.com/CPS0
          Source: wp-s2.exe, 00000001.00000002.2480246518.000001F106690000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2480246518.000001F10682F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.firmaprofesional.com/cps0
          Source: wp-s2.exe, 00000001.00000002.2480794041.000001F106C81000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6
          Source: wp-s2.exe, 00000001.00000002.2480794041.000001F106EE4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1833751555.000001F106F0F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.quovadisglobal.com/cps
          Source: wp-s2.exe, 00000001.00000002.2480794041.000001F106EE4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1833751555.000001F106F0F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.quovadisglobal.com/cps0
          Source: wp-s2.exe, 00000001.00000003.1818662555.000001F106E28000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1834949666.000001F106CD5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2480794041.000001F106CD0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://wwwsearch.sf.net/):
          Source: wp-s2.exe, 00000001.00000002.2480246518.000001F106690000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3.11/library/binascii.html#binascii.a2b_base64
          Source: wp-s2.exe, 00000001.00000002.2480168218.000001F106580000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/howto/mro.html.
          Source: wp-s2.exe, 00000001.00000002.2479813453.000001F106100000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.ExecutionLoader.get_filename
          Source: wp-s2.exe, 00000001.00000002.2479813453.000001F106100000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.get_code
          Source: wp-s2.exe, 00000001.00000002.2479813453.000001F106184000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.get_source
          Source: wp-s2.exe, 00000001.00000002.2479813453.000001F106100000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.is_package
          Source: wp-s2.exe, 00000001.00000002.2479813453.000001F106184000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.Loader.create_module
          Source: wp-s2.exe, 00000001.00000002.2479813453.000001F106100000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.Loader.exec_module
          Source: wp-s2.exe, 00000001.00000002.2479813453.000001F106100000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.MetaPathFinder.invalidate_caches
          Source: wp-s2.exe, 00000001.00000002.2479813453.000001F106100000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.PathEntryFinder.find_spec
          Source: wp-s2.exe, 00000001.00000002.2479706713.000001F104828000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1807315708.000001F10488A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.ResourceLoader.get_data
          Source: wp-s2.exe, 00000001.00000002.2480715624.000001F106AC0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://foss.heptapod.net/pypy/pypy/-/issues/3539
          Source: wp-s2.exe, 00000001.00000003.1818723044.000001F106DBA000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2480794041.000001F106DA2000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1834949666.000001F106DA4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/Ousret/charset_normalizer
          Source: wp-s2.exe, 00000001.00000002.2479706713.000001F104828000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1809960670.000001F10634A000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2480050225.000001F10633A000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1809307804.000001F106348000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1807315708.000001F10488A000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1810151917.000001F10635F000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1811859110.000001F106361000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1811057495.000001F106361000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1809651960.000001F10635F000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1810504940.000001F10635A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy
          Source: wp-s2.exe, 00000001.00000002.2483125033.000001F107C48000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/giampaolo/psutil/issues/875.
          Source: wp-s2.exe, 00000001.00000002.2481707364.000001F107394000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/psf/requests/pull/6710
          Source: wp-s2.exe, 00000001.00000002.2479813453.000001F106184000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688
          Source: wp-s2.exe, 00000001.00000003.1810504940.000001F10635A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py
          Source: wp-s2.exe, 00000001.00000002.2479706713.000001F104828000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1809960670.000001F10634A000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2480050225.000001F10633A000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1809307804.000001F106348000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1807315708.000001F10488A000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1810151917.000001F10635F000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1811859110.000001F106361000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1811057495.000001F106361000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1809651960.000001F10635F000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1810504940.000001F10635A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader
          Source: wp-s2.exe, 00000001.00000002.2480246518.000001F106690000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1813329985.000001F1066FA000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1812557234.000001F1067D9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python/cpython/issues/86361.
          Source: wp-s2.exe, 00000001.00000002.2480636623.000001F1069A0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/python/importlib_metadata/wiki/Development-Methodology
          Source: wp-s2.exe, 00000001.00000002.2479706713.000001F104828000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1809960670.000001F10634A000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2480050225.000001F10633A000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1809307804.000001F106348000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1807315708.000001F10488A000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1810151917.000001F10635F000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1811859110.000001F106361000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1811057495.000001F106361000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1809651960.000001F10635F000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1810504940.000001F10635A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#
          Source: wp-s2.exe, 00000001.00000002.2480715624.000001F106AC0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/urllib3/urllib3/issues/2192#issuecomment-821832963
          Source: wp-s2.exe, 00000001.00000002.2480794041.000001F106BC0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/urllib3/urllib3/issues/2513#issuecomment-1152559900.
          Source: wp-s2.exe, 00000001.00000002.2481413192.000001F1070E0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/urllib3/urllib3/issues/2920
          Source: wp-s2.exe, 00000001.00000002.2481413192.000001F1070E0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/urllib3/urllib3/issues/3290
          Source: wp-s2.exe, 00000001.00000003.1834949666.000001F106CD5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2480794041.000001F106CD0000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1818723044.000001F106DBA000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1834949666.000001F106D47000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2480794041.000001F106D47000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2480794041.000001F106C9F000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2480794041.000001F106DA2000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1834949666.000001F106DA4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://google.com/
          Source: wp-s2.exe, 00000001.00000003.1834949666.000001F106CD5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2480794041.000001F106CD0000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2480794041.000001F106C9F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://google.com/mail
          Source: wp-s2.exe, 00000001.00000003.1834949666.000001F106D47000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://google.com/mail/
          Source: wp-s2.exe, 00000001.00000003.1834949666.000001F106D47000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2480794041.000001F106D47000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://html.spec.whatwg.org/multipage/
          Source: wp-s2.exe, 00000001.00000003.1834949666.000001F106DA4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://httpbin.org/
          Source: wp-s2.exe, 00000001.00000002.2481707364.000001F107340000.00000004.00001000.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1834949666.000001F106D47000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2480794041.000001F106D47000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2480246518.000001F10682F000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2481707364.000001F1073E8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://httpbin.org/get
          Source: wp-s2.exe, 00000001.00000002.2480246518.000001F10687E000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1813329985.000001F106887000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1813329985.000001F10682F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://httpbin.org/post
          Source: wp-s2.exe, 00000001.00000002.2480246518.000001F10682F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://json.org
          Source: wp-s2.exe, 00000001.00000003.1818811452.000001F106DCC000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1818811452.000001F106E34000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2480794041.000001F106DA2000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1834949666.000001F106DA4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://mahler:8092/site-updates.py
          Source: wp-s2.exe, 00000001.00000002.2480636623.000001F1069A0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://nodejs.org/dist/v22.11.0/node-v22.11.0-win-x64.zip
          Source: wp-s2.exe, 00000001.00000002.2481413192.000001F1070E0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://packaging.python.org/en/latest/specifications/core-metadata/#core-metadata
          Source: wp-s2.exe, 00000001.00000002.2480794041.000001F106BC0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://packaging.python.org/en/latest/specifications/entry-points/#file-format
          Source: wp-s2.exe, 00000001.00000002.2480794041.000001F106BC0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://packaging.python.org/en/latest/specifications/recording-installed-packages/#the-record-file
          Source: wp-s2.exe, 00000001.00000002.2481333473.000001F106FE0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://packaging.python.org/specifications/entry-points/
          Source: wp-s2.exe, 00000001.00000003.1807074783.000001F106331000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2480558401.000001F1068A0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://peps.python.org/pep-0205/
          Source: wp-s2.exe, 00000001.00000002.2492067322.00007FFDFB888000.00000002.00000001.01000000.00000004.sdmpString found in binary or memory: https://peps.python.org/pep-0263/
          Source: wp-s2.exe, 00000001.00000002.2481707364.000001F107394000.00000004.00001000.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2480246518.000001F10687E000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1813329985.000001F106887000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1813329985.000001F10682F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://requests.readthedocs.io
          Source: wp-s2.exe, 00000001.00000002.2483125033.000001F107C48000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://stackoverflow.com/questions/4457745#4457745.
          Source: wp-s2.exe, 00000001.00000002.2480794041.000001F106BC0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tools.ietf.org/html/rfc2388#section-4.4
          Source: wp-s2.exe, 00000001.00000002.2480246518.000001F106690000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tools.ietf.org/html/rfc7231#section-4.3.6)
          Source: wp-s2.exe, 00000001.00000003.1818723044.000001F106DBA000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1834949666.000001F106D47000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2480794041.000001F106D47000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2480794041.000001F106DA2000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1834949666.000001F106DA4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://twitter.com/
          Source: wp-s2.exe, 00000001.00000002.2480794041.000001F106D47000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://urllib3.r
          Source: wp-s2.exe, 00000001.00000002.2481333473.000001F106FE0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#https-proxy-error-http-proxy
          Source: wp-s2.exe, 00000001.00000002.2481333473.000001F106FE0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings
          Source: wp-s2.exe, 00000001.00000003.1834949666.000001F106D47000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warningsN
          Source: wp-s2.exe, 00000001.00000002.2480794041.000001F106D47000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://urllib3.rhedo
          Source: wp-s2.exe, 00000000.00000003.1774242555.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1748090007.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1771882919.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1773568388.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1770788946.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1771324699.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1753345379.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1770998747.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1737563531.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1771222145.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1743696412.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1744734720.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1771468917.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1772302388.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1742837267.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1770445463.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1736316426.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1745491092.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1770599441.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1754535612.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1771222145.0000025ADA7A0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.digicert.com/CPS0
          Source: wp-s2.exe, 00000000.00000003.1800969984.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2493990923.00007FFE00560000.00000002.00000001.01000000.00000015.sdmp, wp-s2.exe, 00000001.00000002.2490358233.00007FFDFAC24000.00000002.00000001.01000000.00000014.sdmpString found in binary or memory: https://www.openssl.org/H
          Source: wp-s2.exe, 00000001.00000002.2480246518.000001F10687E000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1813329985.000001F106887000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1813329985.000001F10682F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.python.org
          Source: wp-s2.exe, 00000001.00000003.1818811452.000001F106DCC000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1818811452.000001F106E34000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2480794041.000001F106DA2000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1834949666.000001F106DA4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.python.org/
          Source: wp-s2.exe, 00000001.00000002.2492067322.00007FFDFB888000.00000002.00000001.01000000.00000004.sdmpString found in binary or memory: https://www.python.org/psf/license/)
          Source: wp-s2.exe, 00000001.00000002.2480246518.000001F10682F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.rfc-editor.org/rfc/rfc8259#section-8.1
          Source: wp-s2.exe, 00000001.00000003.1835840263.000001F106F68000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2480794041.000001F106F68000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://wwww.certigna.fr/autorites/
          Source: wp-s2.exe, 00000001.00000003.1835840263.000001F106F68000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2480794041.000001F106F68000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://wwww.certigna.fr/autorites/0m
          Source: wp-s2.exe, 00000001.00000003.1834949666.000001F106CD5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2480794041.000001F106CD0000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2480794041.000001F106C9F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://yahoo.com/
          Source: unknownNetwork traffic detected: HTTP traffic on port 49736 -> 443
          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49736
          Source: C:\Users\user\Desktop\wp-s2.exeCode function: 0_2_00007FF7056908C80_2_00007FF7056908C8
          Source: C:\Users\user\Desktop\wp-s2.exeCode function: 0_2_00007FF7056710000_2_00007FF705671000
          Source: C:\Users\user\Desktop\wp-s2.exeCode function: 0_2_00007FF7056969640_2_00007FF705696964
          Source: C:\Users\user\Desktop\wp-s2.exeCode function: 0_2_00007FF7056789E00_2_00007FF7056789E0
          Source: C:\Users\user\Desktop\wp-s2.exeCode function: 0_2_00007FF705695C000_2_00007FF705695C00
          Source: C:\Users\user\Desktop\wp-s2.exeCode function: 0_2_00007FF705695E7C0_2_00007FF705695E7C
          Source: C:\Users\user\Desktop\wp-s2.exeCode function: 0_2_00007FF70568DEF00_2_00007FF70568DEF0
          Source: C:\Users\user\Desktop\wp-s2.exeCode function: 0_2_00007FF705689EA00_2_00007FF705689EA0
          Source: C:\Users\user\Desktop\wp-s2.exeCode function: 0_2_00007FF70568E5700_2_00007FF70568E570
          Source: C:\Users\user\Desktop\wp-s2.exeCode function: 0_2_00007FF705681D540_2_00007FF705681D54
          Source: C:\Users\user\Desktop\wp-s2.exeCode function: 0_2_00007FF705685D300_2_00007FF705685D30
          Source: C:\Users\user\Desktop\wp-s2.exeCode function: 0_2_00007FF7056835A00_2_00007FF7056835A0
          Source: C:\Users\user\Desktop\wp-s2.exeCode function: 0_2_00007FF7056918740_2_00007FF705691874
          Source: C:\Users\user\Desktop\wp-s2.exeCode function: 0_2_00007FF7056880E40_2_00007FF7056880E4
          Source: C:\Users\user\Desktop\wp-s2.exeCode function: 0_2_00007FF7056940AC0_2_00007FF7056940AC
          Source: C:\Users\user\Desktop\wp-s2.exeCode function: 0_2_00007FF7056887940_2_00007FF705688794
          Source: C:\Users\user\Desktop\wp-s2.exeCode function: 0_2_00007FF705681F600_2_00007FF705681F60
          Source: C:\Users\user\Desktop\wp-s2.exeCode function: 0_2_00007FF7056817400_2_00007FF705681740
          Source: C:\Users\user\Desktop\wp-s2.exeCode function: 0_2_00007FF7056997280_2_00007FF705699728
          Source: C:\Users\user\Desktop\wp-s2.exeCode function: 0_2_00007FF7056798000_2_00007FF705679800
          Source: C:\Users\user\Desktop\wp-s2.exeCode function: 0_2_00007FF70568DA5C0_2_00007FF70568DA5C
          Source: C:\Users\user\Desktop\wp-s2.exeCode function: 0_2_00007FF70567A2DB0_2_00007FF70567A2DB
          Source: C:\Users\user\Desktop\wp-s2.exeCode function: 0_2_00007FF7056821640_2_00007FF705682164
          Source: C:\Users\user\Desktop\wp-s2.exeCode function: 0_2_00007FF7056819440_2_00007FF705681944
          Source: C:\Users\user\Desktop\wp-s2.exeCode function: 0_2_00007FF7056839A40_2_00007FF7056839A4
          Source: C:\Users\user\Desktop\wp-s2.exeCode function: 0_2_00007FF70567A4740_2_00007FF70567A474
          Source: C:\Users\user\Desktop\wp-s2.exeCode function: 0_2_00007FF7056908C80_2_00007FF7056908C8
          Source: C:\Users\user\Desktop\wp-s2.exeCode function: 0_2_00007FF7056964180_2_00007FF705696418
          Source: C:\Users\user\Desktop\wp-s2.exeCode function: 0_2_00007FF70567ACAD0_2_00007FF70567ACAD
          Source: C:\Users\user\Desktop\wp-s2.exeCode function: 0_2_00007FF705681B500_2_00007FF705681B50
          Source: C:\Users\user\Desktop\wp-s2.exeCode function: 0_2_00007FF705693C100_2_00007FF705693C10
          Source: C:\Users\user\Desktop\wp-s2.exeCode function: 0_2_00007FF705682C100_2_00007FF705682C10
          Source: C:\Users\user\Desktop\wp-s2.exeCode function: String function: 00007FF705672710 appears 52 times
          Source: C:\Users\user\Desktop\wp-s2.exeProcess created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 7308 -s 984
          Source: unicodedata.pyd.0.drStatic PE information: Resource name: RT_VERSION type: COM executable for DOS
          Source: python3.dll.0.drStatic PE information: No import functions for PE file found
          Source: wp-s2.exe, 00000000.00000003.1774242555.0000025ADA794000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameqxdgdesktopportal.dll( vs wp-s2.exe
          Source: wp-s2.exe, 00000000.00000003.1750997076.0000025ADA793000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamevcruntime140_1.dllT vs wp-s2.exe
          Source: wp-s2.exe, 00000000.00000003.1771882919.0000025ADA793000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameqwebp.dll( vs wp-s2.exe
          Source: wp-s2.exe, 00000000.00000003.1773568388.0000025ADA793000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameqwindows.dll( vs wp-s2.exe
          Source: wp-s2.exe, 00000000.00000003.1797719666.0000025ADA794000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_lzma.pyd. vs wp-s2.exe
          Source: wp-s2.exe, 00000000.00000003.1770788946.0000025ADA793000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameqicns.dll( vs wp-s2.exe
          Source: wp-s2.exe, 00000000.00000003.1771324699.0000025ADA793000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameqtga.dll( vs wp-s2.exe
          Source: wp-s2.exe, 00000000.00000003.1804322866.0000025ADA794000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameselect.pyd. vs wp-s2.exe
          Source: wp-s2.exe, 00000000.00000003.1797066409.0000025ADA794000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_bz2.pyd. vs wp-s2.exe
          Source: wp-s2.exe, 00000000.00000003.1753345379.0000025ADA793000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename vs wp-s2.exe
          Source: wp-s2.exe, 00000000.00000003.1753345379.0000025ADA793000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamelibEGL.dll. vs wp-s2.exe
          Source: wp-s2.exe, 00000000.00000003.1797956860.0000025ADA794000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_socket.pyd. vs wp-s2.exe
          Source: wp-s2.exe, 00000000.00000003.1770998747.0000025ADA793000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameqjpeg.dll( vs wp-s2.exe
          Source: wp-s2.exe, 00000000.00000003.1737563531.0000025ADA793000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameQt5DBus.dll( vs wp-s2.exe
          Source: wp-s2.exe, 00000000.00000003.1771222145.0000025ADA793000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameqsvg.dll( vs wp-s2.exe
          Source: wp-s2.exe, 00000000.00000003.1743696412.0000025ADA793000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameQt5Qml.dll( vs wp-s2.exe
          Source: wp-s2.exe, 00000000.00000003.1796955936.0000025ADA794000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamevcruntime140_1.dllT vs wp-s2.exe
          Source: wp-s2.exe, 00000000.00000003.1797860226.0000025ADA794000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_queue.pyd. vs wp-s2.exe
          Source: wp-s2.exe, 00000000.00000003.1797347247.0000025ADA794000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_decimal.pyd. vs wp-s2.exe
          Source: wp-s2.exe, 00000000.00000003.1796815557.0000025ADA794000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamevcruntime140.dllT vs wp-s2.exe
          Source: wp-s2.exe, 00000000.00000003.1744734720.0000025ADA793000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameQt5QmlModels.dll( vs wp-s2.exe
          Source: wp-s2.exe, 00000000.00000003.1797196384.0000025ADA794000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_ctypes.pyd. vs wp-s2.exe
          Source: wp-s2.exe, 00000000.00000003.1771468917.0000025ADA793000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameqtiff.dll( vs wp-s2.exe
          Source: wp-s2.exe, 00000000.00000003.1804628337.0000025ADA794000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameunicodedata.pyd. vs wp-s2.exe
          Source: wp-s2.exe, 00000000.00000003.1772302388.0000025ADA793000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameqminimal.dll( vs wp-s2.exe
          Source: wp-s2.exe, 00000000.00000003.1742837267.0000025ADA793000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameQt5Network.dll( vs wp-s2.exe
          Source: wp-s2.exe, 00000000.00000003.1770445463.0000025ADA793000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameqtuiotouchplugin.dll( vs wp-s2.exe
          Source: wp-s2.exe, 00000000.00000003.1736316426.0000025ADA793000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameQt5Core.dll( vs wp-s2.exe
          Source: wp-s2.exe, 00000000.00000003.1770599441.0000025ADA793000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameqsvgicon.dll( vs wp-s2.exe
          Source: wp-s2.exe, 00000000.00000003.1754535612.0000025ADA793000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamelibGLESv2.dll4 vs wp-s2.exe
          Source: wp-s2.exe, 00000000.00000003.1797514749.0000025ADA794000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_hashlib.pyd. vs wp-s2.exe
          Source: wp-s2.exe, 00000000.00000003.1770697607.0000025ADA793000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameqgif.dll( vs wp-s2.exe
          Source: wp-s2.exe, 00000000.00000003.1770880558.0000025ADA793000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameqico.dll( vs wp-s2.exe
          Source: wp-s2.exe, 00000000.00000003.1750785868.0000025ADA793000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamevcruntime140.dllT vs wp-s2.exe
          Source: wp-s2.exe, 00000000.00000003.1771729138.0000025ADA793000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameqwbmp.dll( vs wp-s2.exe
          Source: wp-s2.exe, 00000000.00000003.1772678170.0000025ADA793000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameqoffscreen.dll( vs wp-s2.exe
          Source: wp-s2.exe, 00000000.00000003.1798102603.0000025ADA794000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_ssl.pyd. vs wp-s2.exe
          Source: wp-s2.exe, 00000000.00000003.1798245398.0000025ADA794000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_wmi.pyd. vs wp-s2.exe
          Source: wp-s2.exe, 00000000.00000003.1735205557.0000025ADA791000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamemsvcp140.dllT vs wp-s2.exe
          Source: wp-s2.exe, 00000000.00000003.1774428120.0000025ADA794000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameqwindowsvistastyle.dll( vs wp-s2.exe
          Source: wp-s2.exe, 00000000.00000003.1747001881.0000025ADA793000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameQt5Svg.dll( vs wp-s2.exe
          Source: wp-s2.exe, 00000000.00000003.1800969984.0000025ADA794000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamelibsslH vs wp-s2.exe
          Source: wp-s2.exe, 00000000.00000003.1802046701.0000025ADA794000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamepython3.dll. vs wp-s2.exe
          Source: wp-s2.exe, 00000000.00000003.1773001463.0000025ADA793000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameqwebgl.dll( vs wp-s2.exe
          Source: wp-s2.exe, 00000000.00000003.1739598550.0000025ADA793000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameQt5Gui.dll( vs wp-s2.exe
          Source: wp-s2.exe, 00000000.00000003.1735753907.0000025ADA793000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamemsvcp140_1.dllT vs wp-s2.exe
          Source: wp-s2.exe, 00000000.00000003.1747217130.0000025ADA793000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameQt5WebSockets.dll( vs wp-s2.exe
          Source: wp-s2.exeBinary or memory string: OriginalFilename vs wp-s2.exe
          Source: wp-s2.exe, 00000001.00000002.2487148805.00007FFDF9979000.00000002.00000001.01000000.0000001E.sdmpBinary or memory string: OriginalFilenameQt5Gui.dll( vs wp-s2.exe
          Source: wp-s2.exe, 00000001.00000002.2500557965.00007FFE11522000.00000002.00000001.01000000.00000009.sdmpBinary or memory string: OriginalFilename_bz2.pyd. vs wp-s2.exe
          Source: wp-s2.exe, 00000001.00000002.2498988799.00007FFE0E18A000.00000002.00000001.01000000.00000013.sdmpBinary or memory string: OriginalFilename_ssl.pyd. vs wp-s2.exe
          Source: wp-s2.exe, 00000001.00000002.2500948957.00007FFE11EBE000.00000002.00000001.01000000.00000007.sdmpBinary or memory string: OriginalFilename_ctypes.pyd. vs wp-s2.exe
          Source: wp-s2.exe, 00000001.00000002.2500058574.00007FFE10263000.00000002.00000001.01000000.0000000A.sdmpBinary or memory string: OriginalFilename_lzma.pyd. vs wp-s2.exe
          Source: wp-s2.exe, 00000001.00000002.2501348476.00007FFE12E19000.00000002.00000001.01000000.0000000F.sdmpBinary or memory string: OriginalFilenamevcruntime140_1.dllT vs wp-s2.exe
          Source: wp-s2.exe, 00000001.00000002.2479910791.000001F106200000.00000002.00000001.01000000.00000006.sdmpBinary or memory string: OriginalFilenamepython3.dll. vs wp-s2.exe
          Source: wp-s2.exe, 00000001.00000002.2493466595.00007FFDFBAC0000.00000002.00000001.01000000.00000004.sdmpBinary or memory string: OriginalFilenamepython313.dll. vs wp-s2.exe
          Source: wp-s2.exe, 00000001.00000002.2501481952.00007FFE130C6000.00000002.00000001.01000000.0000000E.sdmpBinary or memory string: OriginalFilenamemsvcp140_1.dllT vs wp-s2.exe
          Source: wp-s2.exe, 00000001.00000002.2497117819.00007FFE0CFE2000.00000002.00000001.01000000.00000021.sdmpBinary or memory string: OriginalFilenameqwindowsvistastyle.dll( vs wp-s2.exe
          Source: wp-s2.exe, 00000001.00000002.2489221330.00007FFDFA72C000.00000002.00000001.01000000.0000001A.sdmpBinary or memory string: OriginalFilenameunicodedata.pyd. vs wp-s2.exe
          Source: wp-s2.exe, 00000001.00000002.2501079117.00007FFE11EEA000.00000002.00000001.01000000.00000005.sdmpBinary or memory string: OriginalFilenamevcruntime140.dllT vs wp-s2.exe
          Source: wp-s2.exe, 00000001.00000002.2487924058.00007FFDF9EC3000.00000002.00000001.01000000.0000001D.sdmpBinary or memory string: OriginalFilenameQt5Widgets.dll( vs wp-s2.exe
          Source: wp-s2.exe, 00000001.00000002.2501210279.00007FFE120C6000.00000002.00000001.01000000.00000012.sdmpBinary or memory string: OriginalFilenameselect.pyd. vs wp-s2.exe
          Source: wp-s2.exe, 00000001.00000002.2493990923.00007FFE00560000.00000002.00000001.01000000.00000015.sdmpBinary or memory string: OriginalFilenamelibsslH vs wp-s2.exe
          Source: wp-s2.exe, 00000001.00000002.2491139641.00007FFDFB190000.00000002.00000001.01000000.0000000C.sdmpBinary or memory string: OriginalFilenameQt5Core.dll( vs wp-s2.exe
          Source: wp-s2.exe, 00000001.00000002.2500685215.00007FFE117E6000.00000002.00000001.01000000.00000017.sdmpBinary or memory string: OriginalFilename_queue.pyd. vs wp-s2.exe
          Source: wp-s2.exe, 00000001.00000002.2490358233.00007FFDFAC24000.00000002.00000001.01000000.00000014.sdmpBinary or memory string: OriginalFilenamelibcryptoH vs wp-s2.exe
          Source: wp-s2.exe, 00000001.00000002.2500264507.00007FFE10313000.00000002.00000001.01000000.00000011.sdmpBinary or memory string: OriginalFilename_socket.pyd. vs wp-s2.exe
          Source: wp-s2.exe, 00000001.00000002.2484952585.00007FFDF907B000.00000002.00000001.01000000.00000020.sdmpBinary or memory string: OriginalFilenameqwindows.dll( vs wp-s2.exe
          Source: wp-s2.exe, 00000001.00000002.2500815001.00007FFE11BBD000.00000002.00000001.01000000.00000016.sdmpBinary or memory string: OriginalFilename_hashlib.pyd. vs wp-s2.exe
          Source: wp-s2.exe, 00000001.00000002.2495203069.00007FFE0137F000.00000002.00000001.01000000.0000000D.sdmpBinary or memory string: OriginalFilenamemsvcp140.dllT vs wp-s2.exe
          Source: Qt5Core.dll.0.drStatic PE information: Section: .qtmimed ZLIB complexity 0.997458770800317
          Source: classification engineClassification label: mal68.troj.spyw.evad.winEXE@13/142@1/1
          Source: C:\Users\user\Desktop\wp-s2.exeMutant created: NULL
          Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7724:120:WilError_03
          Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7492:120:WilError_03
          Source: C:\Windows\System32\WerFault.exeMutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7308
          Source: C:\Users\user\Desktop\wp-s2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI72562Jump to behavior
          Source: wp-s2.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
          Source: C:\Windows\System32\systeminfo.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
          Source: C:\Windows\System32\systeminfo.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
          Source: C:\Users\user\Desktop\wp-s2.exeKey opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
          Source: wp-s2.exeVirustotal: Detection: 8%
          Source: wp-s2.exeString found in binary or memory: <!--StartFragment-->
          Source: C:\Users\user\Desktop\wp-s2.exeFile read: C:\Users\user\Desktop\wp-s2.exeJump to behavior
          Source: unknownProcess created: C:\Users\user\Desktop\wp-s2.exe "C:\Users\user\Desktop\wp-s2.exe"
          Source: C:\Users\user\Desktop\wp-s2.exeProcess created: C:\Users\user\Desktop\wp-s2.exe "C:\Users\user\Desktop\wp-s2.exe"
          Source: C:\Users\user\Desktop\wp-s2.exeProcess created: C:\Windows\System32\systeminfo.exe systeminfo
          Source: C:\Windows\System32\systeminfo.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
          Source: C:\Windows\System32\systeminfo.exeProcess created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
          Source: C:\Users\user\Desktop\wp-s2.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic computersystem get manufacturer"
          Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
          Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wbem\WMIC.exe wmic computersystem get manufacturer
          Source: C:\Users\user\Desktop\wp-s2.exeProcess created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 7308 -s 984
          Source: C:\Users\user\Desktop\wp-s2.exeProcess created: C:\Users\user\Desktop\wp-s2.exe "C:\Users\user\Desktop\wp-s2.exe"Jump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeProcess created: C:\Windows\System32\systeminfo.exe systeminfoJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic computersystem get manufacturer"Jump to behavior
          Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wbem\WMIC.exe wmic computersystem get manufacturerJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeSection loaded: uxtheme.dllJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeSection loaded: kernel.appcore.dllJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeSection loaded: version.dllJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeSection loaded: vcruntime140.dllJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeSection loaded: libffi-8.dllJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeSection loaded: qt5core.dllJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeSection loaded: mpr.dllJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeSection loaded: userenv.dllJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeSection loaded: netapi32.dllJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeSection loaded: winmm.dllJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeSection loaded: msvcp140.dllJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeSection loaded: msvcp140_1.dllJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeSection loaded: vcruntime140_1.dllJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeSection loaded: vcruntime140_1.dllJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeSection loaded: netutils.dllJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeSection loaded: srvcli.dllJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeSection loaded: cryptbase.dllJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeSection loaded: iphlpapi.dllJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeSection loaded: libcrypto-3.dllJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeSection loaded: libssl-3.dllJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeSection loaded: mswsock.dllJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeSection loaded: powrprof.dllJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeSection loaded: pdh.dllJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeSection loaded: umpdc.dllJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeSection loaded: wtsapi32.dllJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeSection loaded: qt5widgets.dllJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeSection loaded: qt5gui.dllJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeSection loaded: qt5gui.dllJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeSection loaded: uxtheme.dllJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeSection loaded: dwmapi.dllJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeSection loaded: d3d11.dllJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeSection loaded: dxgi.dllJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeSection loaded: dxgi.dllJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeSection loaded: kernel.appcore.dllJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeSection loaded: windows.storage.dllJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeSection loaded: wldp.dllJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeSection loaded: profapi.dllJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeSection loaded: d3d9.dllJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeSection loaded: d3d10warp.dllJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeSection loaded: dataexchange.dllJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeSection loaded: dcomp.dllJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeSection loaded: twinapi.appcore.dllJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeSection loaded: dnsapi.dllJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeSection loaded: rasadhlp.dllJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeSection loaded: fwpuclnt.dllJump to behavior
          Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: fastprox.dllJump to behavior
          Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: ncobjapi.dllJump to behavior
          Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: wbemcomn.dllJump to behavior
          Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: wbemcomn.dllJump to behavior
          Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: kernel.appcore.dllJump to behavior
          Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: userenv.dllJump to behavior
          Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: sspicli.dllJump to behavior
          Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: ntmarta.dllJump to behavior
          Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: esscli.dllJump to behavior
          Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: iphlpapi.dllJump to behavior
          Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: framedynos.dllJump to behavior
          Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: sspicli.dllJump to behavior
          Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: kernel.appcore.dllJump to behavior
          Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: wbemcomn.dllJump to behavior
          Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: msxml6.dllJump to behavior
          Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: urlmon.dllJump to behavior
          Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: iertutil.dllJump to behavior
          Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: srvcli.dllJump to behavior
          Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: netutils.dllJump to behavior
          Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: uxtheme.dllJump to behavior
          Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: vcruntime140.dllJump to behavior
          Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: vcruntime140_1.dllJump to behavior
          Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: amsi.dllJump to behavior
          Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: userenv.dllJump to behavior
          Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: profapi.dllJump to behavior
          Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: vbscript.dllJump to behavior
          Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: sxs.dllJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9FC8E510-A27C-4B3B-B9A3-BF65F00256A8}\InProcServer32Jump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeProcess created: C:\Windows\System32\systeminfo.exe systeminfo
          Source: Window RecorderWindow detected: More than 3 window changes detected
          Source: wp-s2.exeStatic PE information: Image base 0x140000000 > 0x60000000
          Source: wp-s2.exeStatic file information: File size 38752565 > 1048576
          Source: wp-s2.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
          Source: wp-s2.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
          Source: wp-s2.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
          Source: wp-s2.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
          Source: wp-s2.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
          Source: wp-s2.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
          Source: wp-s2.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
          Source: wp-s2.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
          Source: Binary string: C:\Users\qt\work\qt\qtsvg\plugins\imageformats\qsvg.pdb source: wp-s2.exe, 00000000.00000003.1771222145.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp
          Source: Binary string: C:\Users\qt\work\qt\qtsvg\plugins\iconengines\qsvgicon.pdb source: wp-s2.exe, 00000000.00000003.1770599441.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp
          Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\generic\qtuiotouchplugin.pdb source: wp-s2.exe, 00000000.00000003.1770445463.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp
          Source: Binary string: d:\agent\_work\1\s\\binaries\amd64ret\bin\amd64\\msvcp140.amd64.pdb source: wp-s2.exe, 00000001.00000002.2494414791.00007FFE01345000.00000002.00000001.01000000.0000000D.sdmp
          Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\imageformats\qico.pdb source: wp-s2.exe, 00000000.00000003.1770880558.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp
          Source: Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG"OpenSSL 3.0.15 3 Sep 20243.0.15built on: Wed Sep 4 15:52:04 2024 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-3"MODULESDIR: "C:\Program Files\OpenSSL\lib\ossl-modules"CPUINFO: N/Anot availableget_and_lock..\s\crypto\ex_data.cossl_crypto_get_ex_new_index_exossl_crypto_new_ex_data_exCRYPTO_dup_ex_dataCRYPTO_set_ex_dataOPENSSL_WIN32_UTF8..\s\crypto\getenv.ccompiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG";CPUINFO: OPENSSL_ia32cap=0x%llx:0x%llxOPENSSL_ia32cap env:%sos-specificC:\Program Files\Common Files\SSLC:\Program Files\OpenSSL\lib\ossl-modules.dllCPUINFO: ..\s\crypto\init.cOPENSSL_init_cryptoOPENSSL_atexit..\s\crypto\initthread.c..\s\crypto\mem_sec.cassertion failed: (bit & 1) == 0assertion failed: list >= 0 && list < sh.freelist_sizeassertion failed: ((ptr - sh.arena) & ((sh.arena_size >> list) - 1)) == 0assertion failed: bit > 0 && bit < sh.bittable_sizeassertion failed: TESTBIT(table, bit)assertion failed: !TESTBIT(table, bit)assertion failed: WITHIN_FREELIST(list)assertion failed: WITHIN_ARENA(ptr)assertion failed: temp->next == NULL || WITHIN_ARENA(temp->next)assertion failed: (char **)temp->next->p_next == listassertion failed: WITHIN_FREELIST(temp2->p_next) || WITHIN_ARENA(temp2->p_next)assertion failed: size > 0assertion failed: (size & (size - 1)) == 0assertion failed: (minsize & (minsize - 1)) == 0assertion failed: sh.freelist != NULLassertion failed: sh.bittable != NULLassertion failed: sh.bitmalloc != NULLassertion failed: !sh_testbit(temp, slist, sh.bitmalloc)assertion failed: temp != sh.freelist[slist]assertion failed: sh.freelist[slist] == tempassertion failed: temp-(sh.arena_size >> slist) == sh_find_my_buddy(temp, slist)assertion failed: sh_testbit(chunk, list, sh.bittable)assertion failed: WITHIN_ARENA(chunk)assertion failed: sh_testbit(ptr, list, sh.bittable)assertion failed: ptr == sh_find_my_buddy(buddy, list)assertion failed: ptr != NULLassertion failed: !sh_testbit(ptr, list, sh.bitmalloc)assertion failed: sh.freelist[list] == ptr/*0123456789ABCDEFCRYPTO_memdup..\s\crypto\o_str.chexstr2buf_sepossl_hexstr2buf_sepbuf2hexstr_sepossl_buf2hexstr_sep..\s\crypto\packet.cwpacket_intern_init_lenWPACKET_start_sub_packet_len__..\s\crypto\param_build.cparam_pushparam_push_numOSSL_PARAM_BLD_push_BN_padNegative big numbers are unsupported for OSSL_PARAMOSSL_PARAM_BLD_push_utf8_stringOSSL_PARAM_BLD_push_utf8_ptrOSSL_PARAM_BLD_push_octet_stringOSSL_PARAM_BLD_p
          Source: Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG" source: wp-s2.exe, 00000001.00000002.2490060691.00007FFDFAAE2000.00000002.00000001.01000000.00000014.sdmp
          Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdbGCTL source: wp-s2.exe, 00000000.00000003.1796815557.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2501028309.00007FFE11EE4000.00000002.00000001.01000000.00000005.sdmp
          Source: Binary string: d:\agent\_work\1\s\\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdb source: wp-s2.exe, 00000000.00000003.1750997076.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2501288886.00007FFE12E15000.00000002.00000001.01000000.0000000F.sdmp
          Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdb source: wp-s2.exe, 00000000.00000003.1796955936.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp
          Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\styles\qwindowsvistastyle.pdb%% source: wp-s2.exe, 00000001.00000002.2496721995.00007FFE0CFD7000.00000002.00000001.01000000.00000021.sdmp
          Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\styles\qwindowsvistastyle.pdb source: wp-s2.exe, 00000001.00000002.2496721995.00007FFE0CFD7000.00000002.00000001.01000000.00000021.sdmp
          Source: Binary string: D:\a\1\b\bin\amd64\_ctypes.pdb source: wp-s2.exe, 00000001.00000002.2500894120.00007FFE11EB3000.00000002.00000001.01000000.00000007.sdmp
          Source: Binary string: C:\Users\qt\work\qt\qtimageformats\plugins\imageformats\qwebp.pdb source: qwebp.dll.0.dr
          Source: Binary string: D:\a\1\b\bin\amd64\_hashlib.pdb source: wp-s2.exe, 00000000.00000003.1797514749.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2500754905.00007FFE11BB6000.00000002.00000001.01000000.00000016.sdmp
          Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\imageformats\qico.pdb source: wp-s2.exe, 00000000.00000003.1770880558.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp
          Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\generic\qtuiotouchplugin.pdb source: wp-s2.exe, 00000000.00000003.1770445463.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp
          Source: Binary string: C:\Users\qt\work\qt\qtbase\lib\Qt5Core.pdbT source: wp-s2.exe, 00000001.00000002.2490662547.00007FFDFB0B6000.00000002.00000001.01000000.0000000C.sdmp
          Source: Binary string: C:\Users\qt\work\qt\qtbase\lib\Qt5Gui.pdb source: wp-s2.exe, 00000001.00000002.2486560927.00007FFDF96FA000.00000002.00000001.01000000.0000001E.sdmp
          Source: Binary string: D:\a\1\b\bin\amd64\_lzma.pdb source: wp-s2.exe, 00000000.00000003.1797719666.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2499967095.00007FFE1025B000.00000002.00000001.01000000.0000000A.sdmp
          Source: Binary string: D:\a\1\b\bin\amd64\_bz2.pdb source: wp-s2.exe, 00000000.00000003.1797066409.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2500504438.00007FFE1151D000.00000002.00000001.01000000.00000009.sdmp
          Source: Binary string: D:\a\1\b\bin\amd64\_socket.pdb source: wp-s2.exe, 00000000.00000003.1797956860.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2500189217.00007FFE10309000.00000002.00000001.01000000.00000011.sdmp
          Source: Binary string: D:\a\1\b\bin\amd64\python313.pdb source: wp-s2.exe, 00000001.00000002.2492067322.00007FFDFB888000.00000002.00000001.01000000.00000004.sdmp
          Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdbGCTL source: wp-s2.exe, 00000000.00000003.1796955936.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp
          Source: Binary string: d:\agent\_work\1\s\\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: wp-s2.exe, 00000000.00000003.1750785868.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp
          Source: Binary string: C:\Users\qt\work\qt\qtimageformats\plugins\imageformats\qtiff.pdbBB source: wp-s2.exe, 00000000.00000003.1771468917.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp
          Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\platformthemes\qxdgdesktopportal.pdb source: wp-s2.exe, 00000000.00000003.1774242555.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp
          Source: Binary string: D:\a\1\b\bin\amd64\unicodedata.pdb source: wp-s2.exe, 00000000.00000003.1804628337.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2489048458.00007FFDFA727000.00000002.00000001.01000000.0000001A.sdmp
          Source: Binary string: d:\agent\_work\1\s\\binaries\amd64ret\bin\amd64\\msvcp140_1.amd64.pdb source: wp-s2.exe, 00000000.00000003.1735753907.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2501431755.00007FFE130C3000.00000002.00000001.01000000.0000000E.sdmp
          Source: Binary string: D:\a\1\b\libcrypto-3.pdb| source: wp-s2.exe, 00000001.00000002.2490060691.00007FFDFAB7A000.00000002.00000001.01000000.00000014.sdmp
          Source: Binary string: D:\a\1\b\libssl-3.pdbDD source: wp-s2.exe, 00000001.00000002.2493837797.00007FFE00525000.00000002.00000001.01000000.00000015.sdmp
          Source: Binary string: C:\Users\qt\work\qt\qtbase\lib\Qt5Core.pdb source: wp-s2.exe, 00000001.00000002.2490662547.00007FFDFB0B6000.00000002.00000001.01000000.0000000C.sdmp
          Source: Binary string: C:\Users\qt\work\qt\qtimageformats\plugins\imageformats\qtiff.pdb source: wp-s2.exe, 00000000.00000003.1771468917.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp
          Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\imageformats\qgif.pdb source: wp-s2.exe, 00000000.00000003.1770697607.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp
          Source: Binary string: D:\a\1\b\bin\amd64\_wmi.pdb(('GCTL source: wp-s2.exe, 00000000.00000003.1798245398.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp
          Source: Binary string: C:\Users\qt\work\qt\qtimageformats\plugins\imageformats\qtga.pdb source: wp-s2.exe, 00000000.00000003.1771324699.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp
          Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: wp-s2.exe, 00000000.00000003.1796815557.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2501028309.00007FFE11EE4000.00000002.00000001.01000000.00000005.sdmp
          Source: Binary string: D:\a\1\b\libcrypto-3.pdb source: wp-s2.exe, 00000001.00000002.2490060691.00007FFDFAB7A000.00000002.00000001.01000000.00000014.sdmp
          Source: Binary string: C:\Users\qt\work\qt\qtimageformats\plugins\imageformats\qicns.pdb source: wp-s2.exe, 00000000.00000003.1770788946.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp
          Source: Binary string: D:\a\1\b\bin\amd64\select.pdb source: wp-s2.exe, 00000000.00000003.1804322866.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2501157443.00007FFE120C3000.00000002.00000001.01000000.00000012.sdmp
          Source: Binary string: D:\a\1\b\bin\amd64\_lzma.pdbNN source: wp-s2.exe, 00000000.00000003.1797719666.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2499967095.00007FFE1025B000.00000002.00000001.01000000.0000000A.sdmp
          Source: Binary string: D:\a\1\b\bin\amd64\_queue.pdb source: wp-s2.exe, 00000000.00000003.1797860226.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2500630743.00007FFE117E3000.00000002.00000001.01000000.00000017.sdmp
          Source: Binary string: D:\a\1\b\bin\amd64\_wmi.pdb source: wp-s2.exe, 00000000.00000003.1798245398.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp
          Source: Binary string: C:\Users\qt\work\qt\qtbase\lib\Qt5Widgets.pdb source: wp-s2.exe, 00000001.00000002.2487611150.00007FFDF9CFA000.00000002.00000001.01000000.0000001D.sdmp
          Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\platforms\qwindows.pdb source: wp-s2.exe, 00000001.00000002.2484669834.00007FFDF9014000.00000002.00000001.01000000.00000020.sdmp
          Source: Binary string: C:\Users\qt\work\qt\qtimageformats\plugins\imageformats\qwbmp.pdb source: wp-s2.exe, 00000000.00000003.1771729138.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp
          Source: Binary string: D:\a\1\b\bin\amd64\python3.pdb source: wp-s2.exe, 00000000.00000003.1802046701.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2479910791.000001F106200000.00000002.00000001.01000000.00000006.sdmp
          Source: Binary string: C:\Users\qt\work\qt\qtbase\lib\libEGL.pdb source: wp-s2.exe, 00000000.00000003.1753345379.0000025ADA793000.00000004.00000020.00020000.00000000.sdmp
          Source: Binary string: D:\a\1\b\libssl-3.pdb source: wp-s2.exe, 00000001.00000002.2493837797.00007FFE00525000.00000002.00000001.01000000.00000015.sdmp
          Source: Binary string: D:\a\1\b\bin\amd64\_ssl.pdb source: wp-s2.exe, 00000001.00000002.2498543448.00007FFE0E16E000.00000002.00000001.01000000.00000013.sdmp
          Source: wp-s2.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
          Source: wp-s2.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
          Source: wp-s2.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
          Source: wp-s2.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
          Source: wp-s2.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata
          Source: VCRUNTIME140.dll.0.drStatic PE information: 0x78BDDED1 [Sat Mar 11 17:01:05 2034 UTC]
          Source: VCRUNTIME140.dll.0.drStatic PE information: section name: fothk
          Source: VCRUNTIME140.dll.0.drStatic PE information: section name: _RDATA
          Source: VCRUNTIME140.dll0.0.drStatic PE information: section name: _RDATA
          Source: opengl32sw.dll.0.drStatic PE information: section name: _RDATA
          Source: qtuiotouchplugin.dll.0.drStatic PE information: section name: .qtmetad
          Source: qsvgicon.dll.0.drStatic PE information: section name: .qtmetad
          Source: MSVCP140.dll.0.drStatic PE information: section name: .didat
          Source: Qt5Core.dll.0.drStatic PE information: section name: .qtmimed
          Source: libcrypto-3.dll.0.drStatic PE information: section name: .00cfg
          Source: qgif.dll.0.drStatic PE information: section name: .qtmetad
          Source: qicns.dll.0.drStatic PE information: section name: .qtmetad
          Source: qico.dll.0.drStatic PE information: section name: .qtmetad
          Source: qjpeg.dll.0.drStatic PE information: section name: .qtmetad
          Source: qsvg.dll.0.drStatic PE information: section name: .qtmetad
          Source: qtga.dll.0.drStatic PE information: section name: .qtmetad
          Source: qtiff.dll.0.drStatic PE information: section name: .qtmetad
          Source: qwbmp.dll.0.drStatic PE information: section name: .qtmetad
          Source: qwebp.dll.0.drStatic PE information: section name: .qtmetad
          Source: qminimal.dll.0.drStatic PE information: section name: .qtmetad
          Source: libssl-3.dll.0.drStatic PE information: section name: .00cfg
          Source: python313.dll.0.drStatic PE information: section name: PyRuntim
          Source: qoffscreen.dll.0.drStatic PE information: section name: .qtmetad
          Source: qwebgl.dll.0.drStatic PE information: section name: .qtmetad
          Source: qwindows.dll.0.drStatic PE information: section name: .qtmetad
          Source: qxdgdesktopportal.dll.0.drStatic PE information: section name: .qtmetad
          Source: qwindowsvistastyle.dll.0.drStatic PE information: section name: .qtmetad
          Source: C:\Users\user\Desktop\wp-s2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\plugins\imageformats\qico.dllJump to dropped file
          Source: C:\Users\user\Desktop\wp-s2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI72562\psutil\_psutil_windows.pydJump to dropped file
          Source: C:\Users\user\Desktop\wp-s2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI72562\libffi-8.dllJump to dropped file
          Source: C:\Users\user\Desktop\wp-s2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\plugins\platforms\qoffscreen.dllJump to dropped file
          Source: C:\Users\user\Desktop\wp-s2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI72562\VCRUNTIME140.dllJump to dropped file
          Source: C:\Users\user\Desktop\wp-s2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\plugins\platforms\qwindows.dllJump to dropped file
          Source: C:\Users\user\Desktop\wp-s2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\plugins\platformthemes\qxdgdesktopportal.dllJump to dropped file
          Source: C:\Users\user\Desktop\wp-s2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\plugins\imageformats\qicns.dllJump to dropped file
          Source: C:\Users\user\Desktop\wp-s2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI72562\libcrypto-3.dllJump to dropped file
          Source: C:\Users\user\Desktop\wp-s2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI72562\_decimal.pydJump to dropped file
          Source: C:\Users\user\Desktop\wp-s2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI72562\_hashlib.pydJump to dropped file
          Source: C:\Users\user\Desktop\wp-s2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\bin\Qt5Qml.dllJump to dropped file
          Source: C:\Users\user\Desktop\wp-s2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\QtGui.pydJump to dropped file
          Source: C:\Users\user\Desktop\wp-s2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\bin\Qt5Svg.dllJump to dropped file
          Source: C:\Users\user\Desktop\wp-s2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\QtWidgets.pydJump to dropped file
          Source: C:\Users\user\Desktop\wp-s2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI72562\_ctypes.pydJump to dropped file
          Source: C:\Users\user\Desktop\wp-s2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\bin\Qt5Core.dllJump to dropped file
          Source: C:\Users\user\Desktop\wp-s2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\bin\d3dcompiler_47.dllJump to dropped file
          Source: C:\Users\user\Desktop\wp-s2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI72562\charset_normalizer\md__mypyc.cp313-win_amd64.pydJump to dropped file
          Source: C:\Users\user\Desktop\wp-s2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI72562\unicodedata.pydJump to dropped file
          Source: C:\Users\user\Desktop\wp-s2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI72562\_socket.pydJump to dropped file
          Source: C:\Users\user\Desktop\wp-s2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\plugins\imageformats\qjpeg.dllJump to dropped file
          Source: C:\Users\user\Desktop\wp-s2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\bin\libEGL.dllJump to dropped file
          Source: C:\Users\user\Desktop\wp-s2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\bin\Qt5QmlModels.dllJump to dropped file
          Source: C:\Users\user\Desktop\wp-s2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI72562\_wmi.pydJump to dropped file
          Source: C:\Users\user\Desktop\wp-s2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\bin\Qt5Quick.dllJump to dropped file
          Source: C:\Users\user\Desktop\wp-s2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI72562\_lzma.pydJump to dropped file
          Source: C:\Users\user\Desktop\wp-s2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI72562\charset_normalizer\md.cp313-win_amd64.pydJump to dropped file
          Source: C:\Users\user\Desktop\wp-s2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\bin\Qt5Network.dllJump to dropped file
          Source: C:\Users\user\Desktop\wp-s2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\bin\VCRUNTIME140.dllJump to dropped file
          Source: C:\Users\user\Desktop\wp-s2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI72562\_ssl.pydJump to dropped file
          Source: C:\Users\user\Desktop\wp-s2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI72562\libssl-3.dllJump to dropped file
          Source: C:\Users\user\Desktop\wp-s2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\plugins\styles\qwindowsvistastyle.dllJump to dropped file
          Source: C:\Users\user\Desktop\wp-s2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\plugins\imageformats\qsvg.dllJump to dropped file
          Source: C:\Users\user\Desktop\wp-s2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\plugins\imageformats\qgif.dllJump to dropped file
          Source: C:\Users\user\Desktop\wp-s2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\plugins\imageformats\qwebp.dllJump to dropped file
          Source: C:\Users\user\Desktop\wp-s2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\bin\opengl32sw.dllJump to dropped file
          Source: C:\Users\user\Desktop\wp-s2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\plugins\imageformats\qtiff.dllJump to dropped file
          Source: C:\Users\user\Desktop\wp-s2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\plugins\platforms\qwebgl.dllJump to dropped file
          Source: C:\Users\user\Desktop\wp-s2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI72562\VCRUNTIME140_1.dllJump to dropped file
          Source: C:\Users\user\Desktop\wp-s2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI72562\python313.dllJump to dropped file
          Source: C:\Users\user\Desktop\wp-s2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\bin\VCRUNTIME140_1.dllJump to dropped file
          Source: C:\Users\user\Desktop\wp-s2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\plugins\imageformats\qtga.dllJump to dropped file
          Source: C:\Users\user\Desktop\wp-s2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI72562\_queue.pydJump to dropped file
          Source: C:\Users\user\Desktop\wp-s2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\sip.cp313-win_amd64.pydJump to dropped file
          Source: C:\Users\user\Desktop\wp-s2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\bin\MSVCP140.dllJump to dropped file
          Source: C:\Users\user\Desktop\wp-s2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\bin\Qt5Widgets.dllJump to dropped file
          Source: C:\Users\user\Desktop\wp-s2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\bin\Qt5Gui.dllJump to dropped file
          Source: C:\Users\user\Desktop\wp-s2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\QtCore.pydJump to dropped file
          Source: C:\Users\user\Desktop\wp-s2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\plugins\iconengines\qsvgicon.dllJump to dropped file
          Source: C:\Users\user\Desktop\wp-s2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\bin\libGLESv2.dllJump to dropped file
          Source: C:\Users\user\Desktop\wp-s2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\bin\Qt5DBus.dllJump to dropped file
          Source: C:\Users\user\Desktop\wp-s2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\plugins\imageformats\qwbmp.dllJump to dropped file
          Source: C:\Users\user\Desktop\wp-s2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\plugins\generic\qtuiotouchplugin.dllJump to dropped file
          Source: C:\Users\user\Desktop\wp-s2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\plugins\platforms\qminimal.dllJump to dropped file
          Source: C:\Users\user\Desktop\wp-s2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI72562\select.pydJump to dropped file
          Source: C:\Users\user\Desktop\wp-s2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI72562\python3.dllJump to dropped file
          Source: C:\Users\user\Desktop\wp-s2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\bin\MSVCP140_1.dllJump to dropped file
          Source: C:\Users\user\Desktop\wp-s2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\bin\Qt5WebSockets.dllJump to dropped file
          Source: C:\Users\user\Desktop\wp-s2.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI72562\_bz2.pydJump to dropped file
          Source: C:\Users\user\Desktop\wp-s2.exeCode function: 0_2_00007FF7056776C0 GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,0_2_00007FF7056776C0
          Source: C:\Users\user\Desktop\wp-s2.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\systeminfo.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\wbem\WMIC.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOXJump to behavior
          Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOXJump to behavior
          Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOXJump to behavior
          Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOXJump to behavior
          Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOXJump to behavior
          Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

          Malware Analysis System Evasion

          barindex
          Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
          Source: C:\Windows\System32\systeminfo.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapter
          Source: C:\Users\user\Desktop\wp-s2.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\plugins\imageformats\qico.dllJump to dropped file
          Source: C:\Users\user\Desktop\wp-s2.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72562\psutil\_psutil_windows.pydJump to dropped file
          Source: C:\Users\user\Desktop\wp-s2.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\plugins\platforms\qoffscreen.dllJump to dropped file
          Source: C:\Users\user\Desktop\wp-s2.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\plugins\platforms\qwindows.dllJump to dropped file
          Source: C:\Users\user\Desktop\wp-s2.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\plugins\platformthemes\qxdgdesktopportal.dllJump to dropped file
          Source: C:\Users\user\Desktop\wp-s2.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\plugins\imageformats\qicns.dllJump to dropped file
          Source: C:\Users\user\Desktop\wp-s2.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72562\_hashlib.pydJump to dropped file
          Source: C:\Users\user\Desktop\wp-s2.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72562\_decimal.pydJump to dropped file
          Source: C:\Users\user\Desktop\wp-s2.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\bin\Qt5Qml.dllJump to dropped file
          Source: C:\Users\user\Desktop\wp-s2.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\bin\Qt5Svg.dllJump to dropped file
          Source: C:\Users\user\Desktop\wp-s2.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\QtGui.pydJump to dropped file
          Source: C:\Users\user\Desktop\wp-s2.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\QtWidgets.pydJump to dropped file
          Source: C:\Users\user\Desktop\wp-s2.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72562\_ctypes.pydJump to dropped file
          Source: C:\Users\user\Desktop\wp-s2.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\bin\d3dcompiler_47.dllJump to dropped file
          Source: C:\Users\user\Desktop\wp-s2.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72562\charset_normalizer\md__mypyc.cp313-win_amd64.pydJump to dropped file
          Source: C:\Users\user\Desktop\wp-s2.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72562\unicodedata.pydJump to dropped file
          Source: C:\Users\user\Desktop\wp-s2.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72562\_socket.pydJump to dropped file
          Source: C:\Users\user\Desktop\wp-s2.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\plugins\imageformats\qjpeg.dllJump to dropped file
          Source: C:\Users\user\Desktop\wp-s2.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\bin\libEGL.dllJump to dropped file
          Source: C:\Users\user\Desktop\wp-s2.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\bin\Qt5QmlModels.dllJump to dropped file
          Source: C:\Users\user\Desktop\wp-s2.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72562\_wmi.pydJump to dropped file
          Source: C:\Users\user\Desktop\wp-s2.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\bin\Qt5Quick.dllJump to dropped file
          Source: C:\Users\user\Desktop\wp-s2.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72562\charset_normalizer\md.cp313-win_amd64.pydJump to dropped file
          Source: C:\Users\user\Desktop\wp-s2.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72562\_lzma.pydJump to dropped file
          Source: C:\Users\user\Desktop\wp-s2.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\bin\Qt5Network.dllJump to dropped file
          Source: C:\Users\user\Desktop\wp-s2.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72562\_ssl.pydJump to dropped file
          Source: C:\Users\user\Desktop\wp-s2.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\plugins\styles\qwindowsvistastyle.dllJump to dropped file
          Source: C:\Users\user\Desktop\wp-s2.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\plugins\imageformats\qsvg.dllJump to dropped file
          Source: C:\Users\user\Desktop\wp-s2.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\plugins\imageformats\qgif.dllJump to dropped file
          Source: C:\Users\user\Desktop\wp-s2.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\plugins\imageformats\qwebp.dllJump to dropped file
          Source: C:\Users\user\Desktop\wp-s2.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\bin\opengl32sw.dllJump to dropped file
          Source: C:\Users\user\Desktop\wp-s2.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\plugins\imageformats\qtiff.dllJump to dropped file
          Source: C:\Users\user\Desktop\wp-s2.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\plugins\platforms\qwebgl.dllJump to dropped file
          Source: C:\Users\user\Desktop\wp-s2.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72562\python313.dllJump to dropped file
          Source: C:\Users\user\Desktop\wp-s2.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\plugins\imageformats\qtga.dllJump to dropped file
          Source: C:\Users\user\Desktop\wp-s2.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72562\_queue.pydJump to dropped file
          Source: C:\Users\user\Desktop\wp-s2.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\sip.cp313-win_amd64.pydJump to dropped file
          Source: C:\Users\user\Desktop\wp-s2.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\plugins\iconengines\qsvgicon.dllJump to dropped file
          Source: C:\Users\user\Desktop\wp-s2.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\QtCore.pydJump to dropped file
          Source: C:\Users\user\Desktop\wp-s2.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\bin\libGLESv2.dllJump to dropped file
          Source: C:\Users\user\Desktop\wp-s2.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\bin\Qt5DBus.dllJump to dropped file
          Source: C:\Users\user\Desktop\wp-s2.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\plugins\imageformats\qwbmp.dllJump to dropped file
          Source: C:\Users\user\Desktop\wp-s2.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\plugins\platforms\qminimal.dllJump to dropped file
          Source: C:\Users\user\Desktop\wp-s2.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\plugins\generic\qtuiotouchplugin.dllJump to dropped file
          Source: C:\Users\user\Desktop\wp-s2.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72562\select.pydJump to dropped file
          Source: C:\Users\user\Desktop\wp-s2.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72562\python3.dllJump to dropped file
          Source: C:\Users\user\Desktop\wp-s2.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\bin\Qt5WebSockets.dllJump to dropped file
          Source: C:\Users\user\Desktop\wp-s2.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72562\_bz2.pydJump to dropped file
          Source: C:\Users\user\Desktop\wp-s2.exeCheck user administrative privileges: GetTokenInformation,DecisionNodesgraph_0-17244
          Source: C:\Windows\System32\systeminfo.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
          Source: C:\Windows\System32\wbem\WMIC.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Manufacturer FROM Win32_ComputerSystem
          Source: C:\Windows\System32\systeminfo.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
          Source: C:\Windows\System32\systeminfo.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
          Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
          Source: C:\Users\user\Desktop\wp-s2.exeCode function: 0_2_00007FF705679280 FindFirstFileExW,FindClose,0_2_00007FF705679280
          Source: C:\Users\user\Desktop\wp-s2.exeCode function: 0_2_00007FF7056783C0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,0_2_00007FF7056783C0
          Source: C:\Users\user\Desktop\wp-s2.exeCode function: 0_2_00007FF705691874 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,0_2_00007FF705691874
          Source: C:\Windows\System32\WerFault.exeFile opened: C:\Users\user\AppData\Local\Temp\_MEI72562\Jump to behavior
          Source: C:\Windows\System32\WerFault.exeFile opened: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\plugins\platforms\Jump to behavior
          Source: C:\Windows\System32\WerFault.exeFile opened: C:\Users\user\AppData\Local\Jump to behavior
          Source: C:\Windows\System32\WerFault.exeFile opened: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\Jump to behavior
          Source: C:\Windows\System32\WerFault.exeFile opened: C:\Users\user\AppData\Jump to behavior
          Source: C:\Windows\System32\WerFault.exeFile opened: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Jump to behavior
          Source: wp-s2.exe, 00000000.00000003.1798818842.0000025ADA794000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: j2aTPs+9xYa9+bG3tD60B8jzljHz7aRP+KNOjSkVWLjVb3/ubCK1sK9IRQq9qEmU
          Source: wp-s2.exe, 00000001.00000002.2480636623.000001F1069A0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: fQEMU
          Source: wp-s2.exe, 00000001.00000002.2480246518.000001F10682F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dlll4
          Source: wp-s2.exe, 00000001.00000002.2481997958.000001F107464000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V Requirements: VM Monitor Mode Extensions: No
          Source: wp-s2.exe, 00000001.00000002.2487087477.00007FFDF9968000.00000008.00000001.01000000.0000001E.sdmpBinary or memory string: .?AVQEmulationPaintEngine@@
          Source: C:\Users\user\Desktop\wp-s2.exeProcess information queried: ProcessInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeCode function: 0_2_00007FF70568A614 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_00007FF70568A614
          Source: C:\Users\user\Desktop\wp-s2.exeCode function: 0_2_00007FF705693480 GetProcessHeap,0_2_00007FF705693480
          Source: C:\Users\user\Desktop\wp-s2.exeProcess token adjusted: DebugJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeProcess token adjusted: DebugJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeCode function: 0_2_00007FF70568A614 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_00007FF70568A614
          Source: C:\Users\user\Desktop\wp-s2.exeCode function: 0_2_00007FF70567C8A0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,0_2_00007FF70567C8A0
          Source: C:\Users\user\Desktop\wp-s2.exeCode function: 0_2_00007FF70567D30C SetUnhandledExceptionFilter,0_2_00007FF70567D30C
          Source: C:\Users\user\Desktop\wp-s2.exeCode function: 0_2_00007FF70567D12C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_00007FF70567D12C
          Source: C:\Users\user\Desktop\wp-s2.exeProcess created: C:\Users\user\Desktop\wp-s2.exe "C:\Users\user\Desktop\wp-s2.exe"Jump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeProcess created: C:\Windows\System32\systeminfo.exe systeminfoJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic computersystem get manufacturer"Jump to behavior
          Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wbem\WMIC.exe wmic computersystem get manufacturerJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeCode function: 0_2_00007FF705699570 cpuid 0_2_00007FF705699570
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\bin VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\bin VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\plugins VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\plugins\imageformats VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\plugins\platforms VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\translations VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\translations VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\translations VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\translations VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\translations VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\translations VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\translations VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\translations VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\translations VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\translations VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\translations VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\translations VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\translations VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\translations VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\translations VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\translations VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\translations VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\translations VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\translations VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\translations VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\translations VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\translations VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\translations VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\translations VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\translations VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\certifi VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\base_library.zip VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\base_library.zip VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\base_library.zip VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\base_library.zip VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\base_library.zip VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\base_library.zip VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\base_library.zip VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\base_library.zip VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\base_library.zip VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\base_library.zip VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\base_library.zip VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\_ctypes.pyd VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\base_library.zip VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\base_library.zip VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\base_library.zip VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\base_library.zip VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\base_library.zip VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\base_library.zip VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\base_library.zip VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\base_library.zip VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\base_library.zip VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\base_library.zip VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\base_library.zip VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\base_library.zip VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\base_library.zip VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\base_library.zip VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\base_library.zip VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\base_library.zip VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\base_library.zip VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\_bz2.pyd VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\_lzma.pyd VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\base_library.zip VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\base_library.zip VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\base_library.zip VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\base_library.zip VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\base_library.zip VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\base_library.zip VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\QtCore.pyd VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\sip.cp313-win_amd64.pyd VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\base_library.zip VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\base_library.zip VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\_socket.pyd VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\select.pyd VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\_ssl.pyd VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\_hashlib.pyd VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\base_library.zip VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\base_library.zip VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\_queue.pyd VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\charset_normalizer VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\charset_normalizer VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\charset_normalizer VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\charset_normalizer\md.cp313-win_amd64.pyd VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\charset_normalizer VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\charset_normalizer\md__mypyc.cp313-win_amd64.pyd VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\unicodedata.pyd VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\certifi VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\base_library.zip VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\base_library.zip VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\psutil VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\psutil VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\psutil VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\psutil\_psutil_windows.pyd VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\QtWidgets.pyd VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\QtGui.pyd VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\plugins\platforms\qminimal.dll VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\plugins\platforms\qoffscreen.dll VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\plugins\platforms\qwebgl.dll VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\plugins\platformthemes\qxdgdesktopportal.dll VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\plugins\styles\qwindowsvistastyle.dll VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\Desktop\wp-s2.exe VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI72562 VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\wp-s2.exeCode function: 0_2_00007FF70567D010 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,0_2_00007FF70567D010
          Source: C:\Users\user\Desktop\wp-s2.exeCode function: 0_2_00007FF705695C00 _get_daylight,_get_daylight,_get_daylight,_get_daylight,_get_daylight,GetTimeZoneInformation,0_2_00007FF705695C00

          Stealing of Sensitive Information

          barindex
          Yara detected Python BackDoor
          Source: Yara matchFile source: 00000001.00000003.1813063325.000001F10684D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000001.00000003.1813329985.000001F10682F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000001.00000002.2480246518.000001F10682F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: Process Memory Space: wp-s2.exe PID: 7308, type: MEMORYSTR
          Opens network shares
          Source: C:\Users\user\Desktop\wp-s2.exeFile opened: \\Mac\shared\projects\loader\src\dropper\src\tmp\_main.pyJump to behavior

          Remote Access Functionality

          barindex
          Yara detected Python BackDoor
          Source: Yara matchFile source: 00000001.00000003.1813063325.000001F10684D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000001.00000003.1813329985.000001F10682F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000001.00000002.2480246518.000001F10682F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: Process Memory Space: wp-s2.exe PID: 7308, type: MEMORYSTR

          Mitre Att&ck Matrix

          ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
          Gather Victim Identity InformationAcquire InfrastructureValid Accounts131
          Windows Management Instrumentation          		1
          DLL Side-Loading          		11
          Process Injection          		12
          Virtualization/Sandbox Evasion          		OS Credential Dumping1
          Network Share Discovery          		Remote Services1
          Archive Collected Data          		12
          Encrypted Channel          		Exfiltration Over Other Network MediumAbuse Accessibility Features
          CredentialsDomainsDefault Accounts2
          Command and Scripting Interpreter          		Boot or Logon Initialization Scripts1
          DLL Side-Loading          		11
          Process Injection          		LSASS Memory2
          System Time Discovery          		Remote Desktop ProtocolData from Removable Media1
          Non-Application Layer Protocol          		Exfiltration Over BluetoothNetwork Denial of Service
          Email AddressesDNS ServerDomain Accounts1
          Native API          		Logon Script (Windows)Logon Script (Windows)1
          Deobfuscate/Decode Files or Information          		Security Account Manager141
          Security Software Discovery          		SMB/Windows Admin SharesData from Network Shared Drive2
          Application Layer Protocol          		Automated ExfiltrationData Encrypted for Impact
          Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook1
          Obfuscated Files or Information          		NTDS12
          Virtualization/Sandbox Evasion          		Distributed Component Object ModelInput CaptureProtocol ImpersonationTraffic DuplicationData Destruction
          Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script1
          Software Packing          		LSA Secrets1
          Process Discovery          		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
          Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts1
          Timestomp          		Cached Domain Credentials2
          File and Directory Discovery          		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
          DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items1
          DLL Side-Loading          		DCSync44
          System Information Discovery          		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery

          Behavior Graph

          Hide Legend

          Legend:

          • Process
          • Signature
          • Created File
          • DNS/IP Info
          • Is Dropped
          • Is Windows Process
          • Number of created Registry Values
          • Number of created Files
          • Visual Basic
          • Delphi
          • Java
          • .Net C# or VB.NET
          • C, C++ or other language
          • Is malicious
          • Internet
          behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1578736 Sample: wp-s2.exe Startdate: 20/12/2024 Architecture: WINDOWS Score: 68 42 nodejs.org 2->42 48 Multi AV Scanner detection for submitted file 2->48 50 Yara detected Python BackDoor 2->50 52 AI detected suspicious sample 2->52 9 wp-s2.exe 153 2->9         started        signatures3 process4 file5 34 C:\Users\user\AppData\...\unicodedata.pyd, PE32+ 9->34 dropped 36 C:\Users\user\AppData\Local\...\select.pyd, PE32+ 9->36 dropped 38 C:\Users\user\AppData\Local\...\python313.dll, PE32+ 9->38 dropped 40 57 other files (none is malicious) 9->40 dropped 12 wp-s2.exe 9->12         started        process6 dnsIp7 44 nodejs.org 104.20.22.46, 443, 49736 CLOUDFLARENETUS United States 12->44 54 Opens network shares 12->54 16 systeminfo.exe 2 1 12->16         started        19 WerFault.exe 19 16 12->19         started        22 cmd.exe 1 12->22         started        signatures8 process9 file10 46 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 16->46 24 WmiPrvSE.exe 16->24         started        26 conhost.exe 16->26         started        32 C:\ProgramData\Microsoft\...\Report.wer, Unicode 19->32 dropped 28 WMIC.exe 1 22->28         started        30 conhost.exe 22->30         started        signatures11 process12

          Screenshots

          Thumbnails

          This section contains all screenshots as thumbnails, including those not shown in the slideshow.


          windows-stand

          Antivirus, Machine Learning and Genetic Malware Detection

          Initial Sample

          SourceDetectionScannerLabelLink
          wp-s2.exe8%VirustotalBrowse
          wp-s2.exe5%ReversingLabsWin64.Trojan.Generic

          Dropped Files

          SourceDetectionScannerLabelLink
          C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\bin\MSVCP140.dll0%ReversingLabs
          C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\bin\MSVCP140_1.dll0%ReversingLabs
          C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\bin\Qt5Core.dll0%ReversingLabs
          C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\bin\Qt5DBus.dll0%ReversingLabs
          C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\bin\Qt5Gui.dll0%ReversingLabs
          C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\bin\Qt5Network.dll0%ReversingLabs
          C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\bin\Qt5Qml.dll0%ReversingLabs
          C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\bin\Qt5QmlModels.dll0%ReversingLabs
          C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\bin\Qt5Quick.dll0%ReversingLabs
          C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\bin\Qt5Svg.dll0%ReversingLabs
          C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\bin\Qt5WebSockets.dll0%ReversingLabs
          C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\bin\Qt5Widgets.dll0%ReversingLabs
          C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\bin\VCRUNTIME140.dll0%ReversingLabs
          C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\bin\VCRUNTIME140_1.dll0%ReversingLabs
          C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\bin\d3dcompiler_47.dll3%ReversingLabs
          C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\bin\libEGL.dll0%ReversingLabs
          C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\bin\libGLESv2.dll0%ReversingLabs
          C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\bin\opengl32sw.dll0%ReversingLabs
          C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\plugins\generic\qtuiotouchplugin.dll0%ReversingLabs
          C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\plugins\iconengines\qsvgicon.dll0%ReversingLabs
          C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\plugins\imageformats\qgif.dll0%ReversingLabs
          C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\plugins\imageformats\qicns.dll0%ReversingLabs
          C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\plugins\imageformats\qico.dll0%ReversingLabs
          C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\plugins\imageformats\qjpeg.dll0%ReversingLabs
          C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\plugins\imageformats\qsvg.dll0%ReversingLabs
          C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\plugins\imageformats\qtga.dll0%ReversingLabs
          C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\plugins\imageformats\qtiff.dll0%ReversingLabs
          C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\plugins\imageformats\qwbmp.dll0%ReversingLabs
          C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\plugins\imageformats\qwebp.dll0%ReversingLabs
          C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\plugins\platforms\qminimal.dll0%ReversingLabs
          C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\plugins\platforms\qoffscreen.dll0%ReversingLabs
          C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\plugins\platforms\qwebgl.dll0%ReversingLabs
          C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\plugins\platforms\qwindows.dll0%ReversingLabs
          C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\plugins\platformthemes\qxdgdesktopportal.dll0%ReversingLabs
          C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\plugins\styles\qwindowsvistastyle.dll0%ReversingLabs
          C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\QtCore.pyd0%ReversingLabs
          C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\QtGui.pyd0%ReversingLabs
          C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\QtWidgets.pyd0%ReversingLabs
          C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\sip.cp313-win_amd64.pyd0%ReversingLabs
          C:\Users\user\AppData\Local\Temp\_MEI72562\VCRUNTIME140.dll0%ReversingLabs
          C:\Users\user\AppData\Local\Temp\_MEI72562\VCRUNTIME140_1.dll0%ReversingLabs
          C:\Users\user\AppData\Local\Temp\_MEI72562\_bz2.pyd0%ReversingLabs
          C:\Users\user\AppData\Local\Temp\_MEI72562\_ctypes.pyd0%ReversingLabs
          C:\Users\user\AppData\Local\Temp\_MEI72562\_decimal.pyd0%ReversingLabs
          C:\Users\user\AppData\Local\Temp\_MEI72562\_hashlib.pyd0%ReversingLabs
          C:\Users\user\AppData\Local\Temp\_MEI72562\_lzma.pyd0%ReversingLabs
          C:\Users\user\AppData\Local\Temp\_MEI72562\_queue.pyd0%ReversingLabs
          C:\Users\user\AppData\Local\Temp\_MEI72562\_socket.pyd0%ReversingLabs
          C:\Users\user\AppData\Local\Temp\_MEI72562\_ssl.pyd0%ReversingLabs
          C:\Users\user\AppData\Local\Temp\_MEI72562\_wmi.pyd0%ReversingLabs
          C:\Users\user\AppData\Local\Temp\_MEI72562\charset_normalizer\md.cp313-win_amd64.pyd0%ReversingLabs
          C:\Users\user\AppData\Local\Temp\_MEI72562\charset_normalizer\md__mypyc.cp313-win_amd64.pyd0%ReversingLabs
          C:\Users\user\AppData\Local\Temp\_MEI72562\libcrypto-3.dll0%ReversingLabs
          C:\Users\user\AppData\Local\Temp\_MEI72562\libffi-8.dll0%ReversingLabs
          C:\Users\user\AppData\Local\Temp\_MEI72562\libssl-3.dll0%ReversingLabs
          C:\Users\user\AppData\Local\Temp\_MEI72562\psutil\_psutil_windows.pyd0%ReversingLabs
          C:\Users\user\AppData\Local\Temp\_MEI72562\python3.dll0%ReversingLabs
          C:\Users\user\AppData\Local\Temp\_MEI72562\python313.dll0%ReversingLabs
          C:\Users\user\AppData\Local\Temp\_MEI72562\select.pyd0%ReversingLabs
          C:\Users\user\AppData\Local\Temp\_MEI72562\unicodedata.pyd0%ReversingLabs

          Unpacked PE Files

          ⊘No Antivirus matches

          Domains

          ⊘No Antivirus matches

          URLs

          ⊘No Antivirus matches

          Domains and IPs

          Contacted Domains

          NameIPActiveMaliciousAntivirus DetectionReputation
          nodejs.org
          		104.20.22.46
          		truefalse
            		high

            URLs from Memory and Binaries

            NameSourceMaliciousAntivirus DetectionReputation
            https://urllib3.rwp-s2.exe, 00000001.00000002.2480794041.000001F106D47000.00000004.00000020.00020000.00000000.sdmpfalse
              		unknown
              https://github.com/giampaolo/psutil/issues/875.wp-s2.exe, 00000001.00000002.2483125033.000001F107C48000.00000004.00001000.00020000.00000000.sdmpfalse
                		high
                https://nodejs.org/dist/v22.11.0/node-v22.11.0-win-x64.zipwp-s2.exe, 00000001.00000002.2480636623.000001F1069A0000.00000004.00001000.00020000.00000000.sdmpfalse
                  		high
                  https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#wp-s2.exe, 00000001.00000002.2479706713.000001F104828000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1809960670.000001F10634A000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2480050225.000001F10633A000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1809307804.000001F106348000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1807315708.000001F10488A000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1810151917.000001F10635F000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1811859110.000001F106361000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1811057495.000001F106361000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1809651960.000001F10635F000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1810504940.000001F10635A000.00000004.00000020.00020000.00000000.sdmpfalse
                    		high
                    https://packaging.python.org/en/latest/specifications/recording-installed-packages/#the-record-filewp-s2.exe, 00000001.00000002.2480794041.000001F106BC0000.00000004.00000020.00020000.00000000.sdmpfalse
                      		high
                      http://goo.gl/zeJZl.wp-s2.exe, 00000001.00000002.2481707364.000001F107400000.00000004.00001000.00020000.00000000.sdmpfalse
                        		high
                        https://tools.ietf.org/html/rfc2388#section-4.4wp-s2.exe, 00000001.00000002.2480794041.000001F106BC0000.00000004.00000020.00020000.00000000.sdmpfalse
                          		high
                          https://docs.python.org/3.11/library/binascii.html#binascii.a2b_base64wp-s2.exe, 00000001.00000002.2480246518.000001F106690000.00000004.00000020.00020000.00000000.sdmpfalse
                            		high
                            https://packaging.python.org/en/latest/specifications/entry-points/#file-formatwp-s2.exe, 00000001.00000002.2480794041.000001F106BC0000.00000004.00000020.00020000.00000000.sdmpfalse
                              		high
                              https://github.com/urllib3/urllib3/issues/2192#issuecomment-821832963wp-s2.exe, 00000001.00000002.2480715624.000001F106AC0000.00000004.00001000.00020000.00000000.sdmpfalse
                                		high
                                http://cacerts.digiwp-s2.exe, 00000000.00000003.1804628337.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000000.00000003.1798102603.0000025ADA794000.00000004.00000020.00020000.00000000.sdmpfalse
                                  		high
                                  https://urllib3.rhedowp-s2.exe, 00000001.00000002.2480794041.000001F106D47000.00000004.00000020.00020000.00000000.sdmpfalse
                                    		unknown
                                    https://peps.python.org/pep-0205/wp-s2.exe, 00000001.00000003.1807074783.000001F106331000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2480558401.000001F1068A0000.00000004.00001000.00020000.00000000.sdmpfalse
                                      		high
                                      http://crl.dhimyotis.com/certignarootca.crlwp-s2.exe, 00000001.00000003.1835840263.000001F106F68000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2480794041.000001F106F68000.00000004.00000020.00020000.00000000.sdmpfalse
                                        		high
                                        http://curl.haxx.se/rfc/cookie_spec.htmlwp-s2.exe, 00000001.00000002.2481492331.000001F107210000.00000004.00001000.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1818662555.000001F106E28000.00000004.00000020.00020000.00000000.sdmpfalse
                                          		high
                                          http://ocsp.accv.eswp-s2.exe, 00000001.00000002.2480794041.000001F106EE4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1833751555.000001F106F0F000.00000004.00000020.00020000.00000000.sdmpfalse
                                            		high
                                            https://docs.python.org/3/library/importlib.html#importlib.abc.ExecutionLoader.get_filenamewp-s2.exe, 00000001.00000002.2479813453.000001F106100000.00000004.00001000.00020000.00000000.sdmpfalse
                                              		high
                                              https://urllib3.readthedocs.io/en/latest/advanced-usage.html#https-proxy-error-http-proxywp-s2.exe, 00000001.00000002.2481333473.000001F106FE0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                		high
                                                https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688wp-s2.exe, 00000001.00000002.2479813453.000001F106184000.00000004.00001000.00020000.00000000.sdmpfalse
                                                  		high
                                                  https://httpbin.org/getwp-s2.exe, 00000001.00000002.2481707364.000001F107340000.00000004.00001000.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1834949666.000001F106D47000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2480794041.000001F106D47000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2480246518.000001F10682F000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2481707364.000001F1073E8000.00000004.00001000.00020000.00000000.sdmpfalse
                                                    		high
                                                    https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.get_codewp-s2.exe, 00000001.00000002.2479813453.000001F106100000.00000004.00001000.00020000.00000000.sdmpfalse
                                                      		high
                                                      https://wwww.certigna.fr/autorites/0mwp-s2.exe, 00000001.00000003.1835840263.000001F106F68000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2480794041.000001F106F68000.00000004.00000020.00020000.00000000.sdmpfalse
                                                        		high
                                                        https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/readerwp-s2.exe, 00000001.00000002.2479706713.000001F104828000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1809960670.000001F10634A000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2480050225.000001F10633A000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1809307804.000001F106348000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1807315708.000001F10488A000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1810151917.000001F10635F000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1811859110.000001F106361000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1811057495.000001F106361000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1809651960.000001F10635F000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1810504940.000001F10635A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                          		high
                                                          https://github.com/python/cpython/issues/86361.wp-s2.exe, 00000001.00000002.2480246518.000001F106690000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1813329985.000001F1066FA000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1812557234.000001F1067D9000.00000004.00000020.00020000.00000000.sdmpfalse
                                                            		high
                                                            http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crlaTwp-s2.exe, 00000001.00000002.2480794041.000001F106EE4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1833751555.000001F106F0F000.00000004.00000020.00020000.00000000.sdmpfalse
                                                              		high
                                                              http://mail.python.org/pipermail/python-dev/2012-June/120787.html.wp-s2.exe, 00000001.00000002.2481492331.000001F107210000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                		high
                                                                https://httpbin.org/wp-s2.exe, 00000001.00000003.1834949666.000001F106DA4000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                  		high
                                                                  https://wwww.certigna.fr/autorites/wp-s2.exe, 00000001.00000003.1835840263.000001F106F68000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2480794041.000001F106F68000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                    		high
                                                                    https://docs.python.org/3/library/importlib.html#importlib.abc.Loader.exec_modulewp-s2.exe, 00000001.00000002.2479813453.000001F106100000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                      		high
                                                                      https://docs.python.org/3/library/importlib.html#importlib.abc.MetaPathFinder.invalidate_cacheswp-s2.exe, 00000001.00000002.2479813453.000001F106100000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                        		high
                                                                        http://www.color.org)wp-s2.exe, 00000001.00000002.2486560927.00007FFDF96FA000.00000002.00000001.01000000.0000001E.sdmpfalse
                                                                          		high
                                                                          http://hg.python.org/cpython/file/603b4d593758/Lib/socket.py#l535wp-s2.exe, 00000001.00000003.1834949666.000001F106CD5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2480794041.000001F106CD0000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                            		high
                                                                            https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sywp-s2.exe, 00000001.00000002.2479706713.000001F104828000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1809960670.000001F10634A000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2480050225.000001F10633A000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1809307804.000001F106348000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1807315708.000001F10488A000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1810151917.000001F10635F000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1811859110.000001F106361000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1811057495.000001F106361000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1809651960.000001F10635F000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1810504940.000001F10635A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                              		high
                                                                              https://packaging.python.org/en/latest/specifications/core-metadata/#core-metadatawp-s2.exe, 00000001.00000002.2481413192.000001F1070E0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                		high
                                                                                http://crl.securetrust.com/STCA.crlwp-s2.exe, 00000001.00000002.2480050225.000001F106396000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                  		high
                                                                                  http://wwwsearch.sf.net/):wp-s2.exe, 00000001.00000003.1818662555.000001F106E28000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1834949666.000001F106CD5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2480794041.000001F106CD0000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                    		high
                                                                                    https://github.com/python/importlib_metadata/wiki/Development-Methodologywp-s2.exe, 00000001.00000002.2480636623.000001F1069A0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                      		high
                                                                                      http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1.crt0wp-s2.exe, 00000001.00000002.2480794041.000001F106EE4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1835840263.000001F106F68000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1833751555.000001F106F0F000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2480794041.000001F106F68000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                        		high
                                                                                        http://www.accv.es/legislacion_c.htmwp-s2.exe, 00000001.00000002.2480794041.000001F106EE4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1833751555.000001F106F0F000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                          		high
                                                                                          http://tools.ietf.org/html/rfc6125#section-6.4.3wp-s2.exe, 00000001.00000002.2481413192.000001F1070E0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                            		high
                                                                                            http://crl.xrampsecurity.com/XGCA.crl0wp-s2.exe, 00000001.00000003.1834949666.000001F106D47000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2480794041.000001F106D47000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                              		high
                                                                                              http://www.cert.fnmt.es/dpcs/wp-s2.exe, 00000001.00000003.1835840263.000001F106F68000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2480794041.000001F106F68000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                		high
                                                                                                https://google.com/mailwp-s2.exe, 00000001.00000003.1834949666.000001F106CD5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2480794041.000001F106CD0000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2480794041.000001F106C9F000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                  		high
                                                                                                  https://packaging.python.org/specifications/entry-points/wp-s2.exe, 00000001.00000002.2481333473.000001F106FE0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                    		high
                                                                                                    http://repository.swisssign.com/h:wp-s2.exe, 00000001.00000002.2480794041.000001F106EE4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1833751555.000001F106F0F000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                      		unknown
                                                                                                      http://www.accv.es00wp-s2.exe, 00000001.00000002.2480794041.000001F106EE4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1835840263.000001F106F68000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1833751555.000001F106F0F000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2480794041.000001F106F68000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                        		high
                                                                                                        https://www.python.org/psf/license/)wp-s2.exe, 00000001.00000002.2492067322.00007FFDFB888000.00000002.00000001.01000000.00000004.sdmpfalse
                                                                                                          		high
                                                                                                          https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.pywp-s2.exe, 00000001.00000003.1810504940.000001F10635A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                            		high
                                                                                                            https://foss.heptapod.net/pypy/pypy/-/issues/3539wp-s2.exe, 00000001.00000002.2480715624.000001F106AC0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                              		high
                                                                                                              https://github.com/urllib3/urllib3/issues/2513#issuecomment-1152559900.wp-s2.exe, 00000001.00000002.2480794041.000001F106BC0000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                		high
                                                                                                                http://google.com/wp-s2.exe, 00000001.00000002.2480794041.000001F106CD0000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                  		high
                                                                                                                  https://mahler:8092/site-updates.pywp-s2.exe, 00000001.00000003.1818811452.000001F106DCC000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1818811452.000001F106E34000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2480794041.000001F106DA2000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1834949666.000001F106DA4000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                    		high
                                                                                                                    http://crl.securetrust.com/SGCA.crlwp-s2.exe, 00000001.00000002.2480050225.000001F106396000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                      		high
                                                                                                                      http://.../back.jpegwp-s2.exe, 00000001.00000002.2481492331.000001F107210000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                        		high
                                                                                                                        https://tools.ietf.org/html/rfc7231#section-4.3.6)wp-s2.exe, 00000001.00000002.2480246518.000001F106690000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                          		high
                                                                                                                          https://httpbin.org/postwp-s2.exe, 00000001.00000002.2480246518.000001F10687E000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1813329985.000001F106887000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1813329985.000001F10682F000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                            		high
                                                                                                                            https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warningsNwp-s2.exe, 00000001.00000003.1834949666.000001F106D47000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                              		high
                                                                                                                              https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.get_sourcewp-s2.exe, 00000001.00000002.2479813453.000001F106184000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                		high
                                                                                                                                http://ocsp.accv.esMa~wp-s2.exe, 00000001.00000002.2480794041.000001F106EE4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1833751555.000001F106F0F000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                  		unknown
                                                                                                                                  https://github.com/Ousret/charset_normalizerwp-s2.exe, 00000001.00000003.1818723044.000001F106DBA000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2480794041.000001F106DA2000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1834949666.000001F106DA4000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                    		high
                                                                                                                                    http://www.firmaprofesional.com/cps0wp-s2.exe, 00000001.00000002.2480246518.000001F106690000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2480246518.000001F10682F000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                      		high
                                                                                                                                      https://docs.python.org/3/library/importlib.html#importlib.abc.PathEntryFinder.find_specwp-s2.exe, 00000001.00000002.2479813453.000001F106100000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                        		high
                                                                                                                                        https://github.com/urllib3/urllib3/issues/2920wp-s2.exe, 00000001.00000002.2481413192.000001F1070E0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                          		high
                                                                                                                                          http://crl.securetrust.com/SGCA.crl0wp-s2.exe, 00000001.00000002.2480794041.000001F106BC0000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                            		high
                                                                                                                                            https://docs.python.org/3/library/importlib.html#importlib.abc.ResourceLoader.get_datawp-s2.exe, 00000001.00000002.2479706713.000001F104828000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1807315708.000001F10488A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                              		high
                                                                                                                                              https://yahoo.com/wp-s2.exe, 00000001.00000003.1834949666.000001F106CD5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2480794041.000001F106CD0000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2480794041.000001F106C9F000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                		high
                                                                                                                                                http://crl.securetrust.com/STCA.crl0wp-s2.exe, 00000001.00000002.2480794041.000001F106BC0000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                  		high
                                                                                                                                                  http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6wp-s2.exe, 00000001.00000002.2480794041.000001F106C81000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                    		high
                                                                                                                                                    https://html.spec.whatwg.org/multipage/wp-s2.exe, 00000001.00000003.1834949666.000001F106D47000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2480794041.000001F106D47000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                      		high
                                                                                                                                                      http://www.quovadisglobal.com/cps0wp-s2.exe, 00000001.00000002.2480794041.000001F106EE4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1833751555.000001F106F0F000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                        		high
                                                                                                                                                        http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crlwp-s2.exe, 00000001.00000002.2480794041.000001F106EE4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1833751555.000001F106F0F000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                          		high
                                                                                                                                                          https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warningswp-s2.exe, 00000001.00000002.2481333473.000001F106FE0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                            		high
                                                                                                                                                            http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl0wp-s2.exe, 00000001.00000003.1835840263.000001F106F68000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2480794041.000001F106F68000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                              		high
                                                                                                                                                              https://www.rfc-editor.org/rfc/rfc8259#section-8.1wp-s2.exe, 00000001.00000002.2480246518.000001F10682F000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                		high
                                                                                                                                                                https://requests.readthedocs.iowp-s2.exe, 00000001.00000002.2481707364.000001F107394000.00000004.00001000.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2480246518.000001F10687E000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1813329985.000001F106887000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1813329985.000001F10682F000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                  		high
                                                                                                                                                                  http://repository.swisssign.com/wp-s2.exe, 00000001.00000002.2480794041.000001F106EE4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1833751555.000001F106F0F000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2480794041.000001F106D2B000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1834949666.000001F106D2B000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2480794041.000001F106DA2000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1834949666.000001F106DA4000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                    		high
                                                                                                                                                                    http://crl.xrampsecurity.com/XGCA.crlwp-s2.exe, 00000001.00000002.2480050225.000001F106396000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                      		high
                                                                                                                                                                      http://www.cert.fnmt.es/dpcs/nwp-s2.exe, 00000001.00000003.1835840263.000001F106F68000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2480794041.000001F106F68000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                        		high
                                                                                                                                                                        https://www.python.orgwp-s2.exe, 00000001.00000002.2480246518.000001F10687E000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1813329985.000001F106887000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1813329985.000001F10682F000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                          		high
                                                                                                                                                                          http://code.activestate.com/recipes/577452-a-memoize-decorator-for-instance-methods/wp-s2.exe, 00000001.00000003.1834949666.000001F106D47000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2480794041.000001F106D47000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                            		high
                                                                                                                                                                            http://www.accv.es/legislacion_c.htm0Uwp-s2.exe, 00000001.00000003.1835840263.000001F106F68000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2480794041.000001F106F68000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                              		high
                                                                                                                                                                              http://www.aiim.org/pdfa/ns/id/wp-s2.exe, 00000001.00000002.2486560927.00007FFDF96FA000.00000002.00000001.01000000.0000001E.sdmpfalse
                                                                                                                                                                                		high
                                                                                                                                                                                http://ocsp.accv.es0wp-s2.exe, 00000001.00000003.1835840263.000001F106F68000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2480794041.000001F106F68000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                  		high
                                                                                                                                                                                  https://www.python.org/wp-s2.exe, 00000001.00000003.1818811452.000001F106DCC000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1818811452.000001F106E34000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2480794041.000001F106DA2000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1834949666.000001F106DA4000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                    		high
                                                                                                                                                                                    https://json.orgwp-s2.exe, 00000001.00000002.2480246518.000001F10682F000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                      		high
                                                                                                                                                                                      https://docs.python.org/3/howto/mro.html.wp-s2.exe, 00000001.00000002.2480168218.000001F106580000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                                        		high
                                                                                                                                                                                        https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.is_packagewp-s2.exe, 00000001.00000002.2479813453.000001F106100000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                                          		high
                                                                                                                                                                                          https://twitter.com/wp-s2.exe, 00000001.00000003.1818723044.000001F106DBA000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1834949666.000001F106D47000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2480794041.000001F106D47000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2480794041.000001F106DA2000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1834949666.000001F106DA4000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                            		high
                                                                                                                                                                                            https://stackoverflow.com/questions/4457745#4457745.wp-s2.exe, 00000001.00000002.2483125033.000001F107C48000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                                              		high
                                                                                                                                                                                              http://www.quovadisglobal.com/cpswp-s2.exe, 00000001.00000002.2480794041.000001F106EE4000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1833751555.000001F106F0F000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                		high
                                                                                                                                                                                                https://docs.python.org/3/library/importlib.html#importlib.abc.Loader.create_modulewp-s2.exe, 00000001.00000002.2479813453.000001F106184000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                                                  		high
                                                                                                                                                                                                  https://google.com/wp-s2.exe, 00000001.00000003.1834949666.000001F106CD5000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2480794041.000001F106CD0000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1818723044.000001F106DBA000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1834949666.000001F106D47000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2480794041.000001F106D47000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2480794041.000001F106C9F000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2480794041.000001F106DA2000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000003.1834949666.000001F106DA4000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                    		high
                                                                                                                                                                                                    https://google.com/mail/wp-s2.exe, 00000001.00000003.1834949666.000001F106D47000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                      		high
                                                                                                                                                                                                      http://google.com/mail/wp-s2.exe, 00000001.00000002.2480794041.000001F106BC0000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                        		high
                                                                                                                                                                                                        https://github.com/urllib3/urllib3/issues/3290wp-s2.exe, 00000001.00000002.2481413192.000001F1070E0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                                                          		high
                                                                                                                                                                                                          https://www.openssl.org/Hwp-s2.exe, 00000000.00000003.1800969984.0000025ADA794000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2493990923.00007FFE00560000.00000002.00000001.01000000.00000015.sdmp, wp-s2.exe, 00000001.00000002.2490358233.00007FFDFAC24000.00000002.00000001.01000000.00000014.sdmpfalse
                                                                                                                                                                                                            		high
                                                                                                                                                                                                            http://www.cert.fnmt.es/dpcs/:wp-s2.exe, 00000001.00000002.2480794041.000001F106BC0000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                              		high
                                                                                                                                                                                                              http://crl.certigna.fr/certignarootca.crl01wp-s2.exe, 00000001.00000003.1835840263.000001F106F68000.00000004.00000020.00020000.00000000.sdmp, wp-s2.exe, 00000001.00000002.2480794041.000001F106F68000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                                		high
                                                                                                                                                                                                                http://www.cert.fnmt.es/dpcs/0wp-s2.exe, 00000001.00000002.2480050225.000001F106396000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                                  		high
                                                                                                                                                                                                                  https://peps.python.org/pep-0263/wp-s2.exe, 00000001.00000002.2492067322.00007FFDFB888000.00000002.00000001.01000000.00000004.sdmpfalse
                                                                                                                                                                                                                    		high

                                                                                                                                                                                                                    World Map of Contacted IPs

                                                                                                                                                                                                                    • No. of IPs < 25%
                                                                                                                                                                                                                    • 25% < No. of IPs < 50%
                                                                                                                                                                                                                    • 50% < No. of IPs < 75%
                                                                                                                                                                                                                    • 75% < No. of IPs

                                                                                                                                                                                                                    Public IPs

                                                                                                                                                                                                                    IPDomainCountryFlagASNASN NameMalicious
                                                                                                                                                                                                                    104.20.22.46
                                                                                                                                                                                                                    		nodejs.orgUnited States
                                                                                                                                                                                                                    		13335CLOUDFLARENETUSfalse

                                                                                                                                                                                                                    General Information

                                                                                                                                                                                                                    Joe Sandbox version:41.0.0 Charoite
                                                                                                                                                                                                                    Analysis ID:1578736
                                                                                                                                                                                                                    Start date and time:2024-12-20 10:04:26 +01:00
                                                                                                                                                                                                                    Joe Sandbox product:CloudBasic
                                                                                                                                                                                                                    Overall analysis duration:0h 10m 19s
                                                                                                                                                                                                                    Hypervisor based Inspection enabled:false
                                                                                                                                                                                                                    Report type:full
                                                                                                                                                                                                                    Cookbook file name:default.jbs
                                                                                                                                                                                                                    Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                                                                                                                                                                                    Run name:Run with higher sleep bypass
                                                                                                                                                                                                                    Number of analysed new started processes analysed:15
                                                                                                                                                                                                                    Number of new started drivers analysed:0
                                                                                                                                                                                                                    Number of existing processes analysed:0
                                                                                                                                                                                                                    Number of existing drivers analysed:0
                                                                                                                                                                                                                    Number of injected processes analysed:0
                                                                                                                                                                                                                    Technologies:
                                                                                                                                                                                                                    • HCA enabled
                                                                                                                                                                                                                    • EGA enabled
                                                                                                                                                                                                                    • AMSI enabled
                                                                                                                                                                                                                    Analysis Mode:default
                                                                                                                                                                                                                    Analysis stop reason:Timeout
                                                                                                                                                                                                                    Sample name:wp-s2.exe
                                                                                                                                                                                                                    Detection:MAL
                                                                                                                                                                                                                    Classification:mal68.troj.spyw.evad.winEXE@13/142@1/1
                                                                                                                                                                                                                    EGA Information:
                                                                                                                                                                                                                    • Successful, ratio: 50%
                                                                                                                                                                                                                    HCA Information:
                                                                                                                                                                                                                    • Successful, ratio: 74%
                                                                                                                                                                                                                    • Number of executed functions: 40
                                                                                                                                                                                                                    • Number of non-executed functions: 72
                                                                                                                                                                                                                    Cookbook Comments:
                                                                                                                                                                                                                    • Found application associated with file extension: .exe
                                                                                                                                                                                                                    • Sleeps bigger than 100000000ms are automatically reduced to 1000ms
                                                                                                                                                                                                                    • Sleep loops longer than 100000000ms are bypassed. Single calls with delay of 100000000ms and higher are ignored

                                                                                                                                                                                                                    Warnings

                                                                                                                                                                                                                    • Exclude process from analysis (whitelisted): MpCmdRun.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
                                                                                                                                                                                                                    • Excluded IPs from analysis (whitelisted): 13.89.179.12, 20.12.23.50, 20.190.177.146, 13.107.246.63
                                                                                                                                                                                                                    • Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, login.live.com, otelrules.azureedge.net, blobcollector.events.data.trafficmanager.net, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, onedsblobprdcus17.centralus.cloudapp.azure.com, fe3cr.delivery.mp.microsoft.com
                                                                                                                                                                                                                    • Execution Graph export aborted for target wp-s2.exe, PID 7308 because there are no executed function
                                                                                                                                                                                                                    • Not all processes where analyzed, report is missing behavior information
                                                                                                                                                                                                                    • Report size exceeded maximum capacity and may have missing behavior information.
                                                                                                                                                                                                                    • Report size getting too big, too many NtProtectVirtualMemory calls found.

                                                                                                                                                                                                                    Simulations

                                                                                                                                                                                                                    Behavior and APIs

                                                                                                                                                                                                                    ⊘No simulations

                                                                                                                                                                                                                    Joe Sandbox View / Context

                                                                                                                                                                                                                    IPs

                                                                                                                                                                                                                    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                                    104.20.22.46wp-cent.exeGet hashmaliciousPython BackDoorBrowse
                                                                                                                                                                                                                      wp-cent.exeGet hashmaliciousPython BackDoorBrowse
                                                                                                                                                                                                                        WTvNL75dCr.exeGet hashmaliciousPython BackDoorBrowse
                                                                                                                                                                                                                          WTvNL75dCr.exeGet hashmaliciousPython BackDoorBrowse
                                                                                                                                                                                                                            wmdqEYgW2i.exeGet hashmaliciousDCRat, PureLog Stealer, zgRATBrowse
                                                                                                                                                                                                                              Bootstrapper.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                download.ps1Get hashmaliciousPython BackDoorBrowse
                                                                                                                                                                                                                                  y3x8pjQ1Ci.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                    download.ps1Get hashmaliciousUnknownBrowse

                                                                                                                                                                                                                                      Domains

                                                                                                                                                                                                                                      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                                                      nodejs.orgwp-cent.exeGet hashmaliciousPython BackDoorBrowse
                                                                                                                                                                                                                                      • 104.20.22.46
                                                                                                                                                                                                                                      wp-cent.exeGet hashmaliciousPython BackDoorBrowse
                                                                                                                                                                                                                                      • 104.20.22.46
                                                                                                                                                                                                                                      WTvNL75dCr.exeGet hashmaliciousPython BackDoorBrowse
                                                                                                                                                                                                                                      • 104.20.22.46
                                                                                                                                                                                                                                      WTvNL75dCr.exeGet hashmaliciousPython BackDoorBrowse
                                                                                                                                                                                                                                      • 104.20.22.46
                                                                                                                                                                                                                                      wmdqEYgW2i.exeGet hashmaliciousDCRat, PureLog Stealer, zgRATBrowse
                                                                                                                                                                                                                                      • 104.20.22.46
                                                                                                                                                                                                                                      Bootstrapper.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                      • 104.20.22.46
                                                                                                                                                                                                                                      https://f29cc861.solaraweb-alj.pages.dev/download/static/files/Bootstrapper.exeGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                                                      • 104.20.23.46
                                                                                                                                                                                                                                      download.ps1Get hashmaliciousPython BackDoorBrowse
                                                                                                                                                                                                                                      • 104.20.22.46

                                                                                                                                                                                                                                      ASNs

                                                                                                                                                                                                                                      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                                                      CLOUDFLARENETUShttps://p.placed.com/api/v2/sync/impression?partner=barkley&plaid=0063o000014sWgoAAE&version=1.0&payload_campaign_identifier=71700000100870630&payload_timestamp=5943094174221506287&payload_type=impression&redirect=http%3A%2F%2Fgoogle.com%2Famp%2Fs%2Fgoal.com.co%2Fwp%2FpaymentGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                                                      • 104.16.123.96
                                                                                                                                                                                                                                      YU SV Payment.exeGet hashmaliciousMassLogger RATBrowse
                                                                                                                                                                                                                                      • 172.67.177.134
                                                                                                                                                                                                                                      file.exeGet hashmaliciousLummaC, Amadey, LummaC Stealer, PureLog Stealer, RHADAMANTHYS, zgRATBrowse
                                                                                                                                                                                                                                      • 104.21.67.146
                                                                                                                                                                                                                                      https://u46509964.ct.sendgrid.net/ls/click?upn=u001.16O0hg1-2FLz1kpPxGHUZbqTUnkidniSFIXbuQ0K27NKGR5E4qQP4y3-2BK2LCxUfHTmD8VAoWu9fqrv96heRY-2BDaw-3D-3DTW9l_kcz-2FW2m7wWBC5iX2nmYizXpnEWoSr8Rc5lqOd2Tm8BrX2ha7XCwhAEdfUnTDQdcFlDoClQCenTHrYqYGrvROsmQGK19xExQ3O8UU0JUBZANb3FsycXG0lXfAeU6Ge3kEKNmMydUTpk2mvytxKM8NWM4-2BCe9md9gsZjY-2FmreGd712h4QJlOUlhQy19VQuOzLTR0hg5YGbygTAwGERJ0n3IsJQDuwHOGcAqA18p5ElbhIowXEJo1-2FUNhaAkl3hll56dS6aJMfJ2Cg7jctNhsypZwMqKm18nIQwqxy0HjDjPtDlRcWFBii-2BIabVdhAMwhtvbY-2BhH45kGHgqL1VbALLhTExLjDfFJ4Mdg1hbx5shtVSm69xnT8S0os3NwgUPcP6MZcGvFpVYjCIpNJRmEhnpApXmFzR0GdBotdIKDeKv3ZVh61As-2FSNo3vfT6a-2F1G6CSiTaxzhsqh2H-2BbaxKc9CNbAVT-2BT7dLfv3mwuz99sF3ZWYAQVhK-2FC3sPsTl5X4hdzGiFwatwFf8YUFBISMNX22jwRHFRxLR66dQgVtYo7IumZ-2FOZfPJ2G3u57Las-2FXsx3SO8XE1W1y4QspPQeH1YjVMsZnAeeR8w-2FvWRwY1A7qeifyIBD1fUq-2B4bmZYMnqZ3q5oEXMCBqA-2Fhiv6OawVXsyA5vOFgFJ9F0GjgBX8N-2FlVTcBHanqEGbxSYzxEvDD4r3DBgXj6FxUKNaXGPhd18AzzCXeX88LcJxWAPd-2Fv7JiB88FpQ5kwb7TyWiLLfMzbetfGykMOctbu8W3BbDsIyadCguknOKT9sBLCEKiPAam3h8kh-2BsXXxkR2EvqCeFfErZ3PwKa1SVHAEbQojZZV7jqlLyJR8KYd7Ob5ZMYMENFHn0kgSi7eB-2FawHwHTrEhLDYX-2BOWrkMOQimBc4NTUUy5DbdiVfhlyh7bL6srP-2ByInzpsE8pygdal5s3pCDu8-2F94-2B1f3C1MQ9-2FkWFJVilN3Xiglg-3D-3DGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                      • 104.18.142.119
                                                                                                                                                                                                                                      ktyihkdfesf.exeGet hashmaliciousVidarBrowse
                                                                                                                                                                                                                                      • 172.64.41.3
                                                                                                                                                                                                                                      pjthjsdjgjrtavv.exeGet hashmaliciousVidarBrowse
                                                                                                                                                                                                                                      • 172.64.41.3
                                                                                                                                                                                                                                      Captcha.htaGet hashmaliciousLummaC, Cobalt Strike, HTMLPhisher, LummaC StealerBrowse
                                                                                                                                                                                                                                      • 172.67.197.170
                                                                                                                                                                                                                                      file.exeGet hashmaliciousLummaC, Amadey, Cryptbot, LummaC StealerBrowse
                                                                                                                                                                                                                                      • 172.67.180.113
                                                                                                                                                                                                                                      8ZVMneG.exeGet hashmaliciousLummaCBrowse
                                                                                                                                                                                                                                      • 104.21.66.86

                                                                                                                                                                                                                                      JA3 Fingerprints

                                                                                                                                                                                                                                      ⊘No context

                                                                                                                                                                                                                                      Dropped Files

                                                                                                                                                                                                                                      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\bin\MSVCP140.dllwp-cent.exeGet hashmaliciousPython BackDoorBrowse
                                                                                                                                                                                                                                        wp-cent.exeGet hashmaliciousPython BackDoorBrowse
                                                                                                                                                                                                                                          WTvNL75dCr.exeGet hashmaliciousPython BackDoorBrowse
                                                                                                                                                                                                                                            WTvNL75dCr.exeGet hashmaliciousPython BackDoorBrowse
                                                                                                                                                                                                                                              FileScanner.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                MacAttack.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                  download.ps1Get hashmaliciousPython BackDoorBrowse
                                                                                                                                                                                                                                                    y3x8pjQ1Ci.exeGet hashmaliciousUnknownBrowse

                                                                                                                                                                                                                                                      Created / dropped Files

                                                                                                                                                                                                                                                      C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_wp-s2.exe_2b6876b9d34de520d6e735f39948ec398686c89_c328f930_44f879cd-245d-4838-96b0-21eb44841777\Report.wer

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Windows\System32\WerFault.exe
                                                                                                                                                                                                                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):65536
                                                                                                                                                                                                                                                      Entropy (8bit):1.3494805331204114
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:192:A15F+F0pgzHjoR7tK6bnVz7ExBeBbe0G/bkLhCmzgYwnCjMw74xV8xv1SnYzuiFQ:+L+mpgzHjUXwnGBRzuiFvY4lO8Y
                                                                                                                                                                                                                                                      MD5:95A2029D88D88ACA633D931DB2EABB5A
                                                                                                                                                                                                                                                      SHA1:0C9CFDCD4116AD67D76C7387E9988E1B36D05398
                                                                                                                                                                                                                                                      SHA-256:5D34542F2B782D74561AF44B154395A0EC5010ECCCED8B7BEF0402D973F03E85
                                                                                                                                                                                                                                                      SHA-512:2640889A8828421336E178547C79FDDF840635FDDE724795584304652099F64CC1068DD9501C68DF6F34BF2B551D960D3CC98D1792219CA83BEDFF1A7574739C
                                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                                                                                      Preview:..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.6.4.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.9.1.5.9.1.4.7.0.6.1.3.7.2.5.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.9.1.5.9.1.4.7.5.3.0.1.1.8.9.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.4.4.f.8.7.9.c.d.-.2.4.5.d.-.4.8.3.8.-.9.6.b.0.-.2.1.e.b.4.4.8.4.1.7.7.7.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.0.5.2.7.8.8.5.0.-.9.3.9.e.-.4.2.8.9.-.b.6.3.1.-.b.1.7.d.e.4.c.c.8.4.9.1.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.w.p.-.s.2...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.c.8.c.-.0.0.0.1.-.0.0.1.4.-.1.a.9.b.-.a.9.5.1.b.e.5.2.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.4.4.7.4.a.d.6.1.0.0.0.a.e.e.2.d.c.d.d.5.d.b.0.c.b.0.e.5.e.8.a.f.0.0.0.0.f.f.f.f.!.0.0.0.0.8.7.c.e.8.6.a.7.6.9.e.f.3.9.e.f.b.4.d.c.f.c.1.7.6.1.8.7.7.d.8.3.7.c.5.2.f.b.a.c.!.w.p.-.s.2...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.1.2././.1.6.:.1.2.:.3.1.:.5.9.!.2.4.f.

                                                                                                                                                                                                                                                      C:\ProgramData\Microsoft\Windows\WER\Temp\WERB8C6.tmp.dmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Windows\System32\WerFault.exe
                                                                                                                                                                                                                                                      File Type:Mini DuMP crash report, 15 streams, Fri Dec 20 09:05:47 2024, 0x1205a4 type
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):134596
                                                                                                                                                                                                                                                      Entropy (8bit):2.004002292261265
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:384:9868CurHkVC3IYhR2xA6FBB2O0Ki7wPnzz+W6H8dhOqR/H7Nd:984urEi76AwsOKeWzHrIj
                                                                                                                                                                                                                                                      MD5:0750884CCE7F1FF035D0977103F50BB3
                                                                                                                                                                                                                                                      SHA1:A792A655A725247F75A5BF64A5D17E77677B8C27
                                                                                                                                                                                                                                                      SHA-256:E2D5B40FE787222BE65D79AC0DD4D47F31E90281BEA5FEF3927EB327AC025C08
                                                                                                                                                                                                                                                      SHA-512:B3FF6C8E84BE005884C88157EE03291A74ECE3EFF02B6506A14D556288C79078444CC028DB155FB05F77822409CC12ABB3E66409E2B4FA97DF5DE151F439F3DB
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:MDMP..a..... .......k3eg............$............%..8.......$....-...........\..........`.......8...........T............%...............-.........../..............................................................................eJ......p0......Lw......................T...........Z3eg.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\ProgramData\Microsoft\Windows\WER\Temp\WERB9D1.tmp.WERInternalMetadata.xml

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Windows\System32\WerFault.exe
                                                                                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):9620
                                                                                                                                                                                                                                                      Entropy (8bit):3.708100894228113
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:192:R6l7wVeJuDYTMTX6Ycz+3lPgmf7npDa89bYv/DfvIm:R6lXJqYQj6YY+3lPgmf7hY3Df1
                                                                                                                                                                                                                                                      MD5:069047926FA645EE20DD3BC3697301B5
                                                                                                                                                                                                                                                      SHA1:06F672D08F37AD384059BB98E495FBE03F30FAF8
                                                                                                                                                                                                                                                      SHA-256:B73820DFBE212226EB7583D71426DE46536BAA1ACF9580DFBAE1F977A90EF0A9
                                                                                                                                                                                                                                                      SHA-512:0CFFF1A849E29F86B1F559587760304D53F4971755CF5367160425768FB48B6DE45D61F1F813BAB56283F8CD11DB394AC663C8F3DA2686424A1315013F934CA6
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.3.0.8.<./.P.i.

                                                                                                                                                                                                                                                      C:\ProgramData\Microsoft\Windows\WER\Temp\WERB9F1.tmp.xml

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Windows\System32\WerFault.exe
                                                                                                                                                                                                                                                      File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):4735
                                                                                                                                                                                                                                                      Entropy (8bit):4.429405084933825
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:48:cvIwWl8zsDJg771I9mZWpW8VYKYm8M4JzWDFhmyq8vVWAGR88zL4d:uIjfdI7No7VaJaqWUAGR88zL4d
                                                                                                                                                                                                                                                      MD5:0CA0977C6CE1DE86953DE301E4FBE2AC
                                                                                                                                                                                                                                                      SHA1:7050A6C2DD079A0FA1F7B7AB36338E8BDFAB39E2
                                                                                                                                                                                                                                                      SHA-256:0C2FD9423EB592B6E9579D4C66E8C67D4D06F17FBC98C62E39DBBF5B68D380D4
                                                                                                                                                                                                                                                      SHA-512:5DAABC68FCC0D5AD72F6C322FF44AAC0ABB93330EF6C60972FB9E66EB593FB078EA446EEFEAD2134E0EA09957BB2C1126F19C39A74F940A18BFB6B0015406CC4
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="639368" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\bin\MSVCP140.dll

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):590112
                                                                                                                                                                                                                                                      Entropy (8bit):6.461874649448891
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:12288:xI88L4Wu4+oJ+xc39ax5Ms4ETs3rxSvYcRkdQEKZm+jWodEEVh51:xD89rxZfQEKZm+jWodEEP5
                                                                                                                                                                                                                                                      MD5:01B946A2EDC5CC166DE018DBB754B69C
                                                                                                                                                                                                                                                      SHA1:DBE09B7B9AB2D1A61EF63395111D2EB9B04F0A46
                                                                                                                                                                                                                                                      SHA-256:88F55D86B50B0A7E55E71AD2D8F7552146BA26E927230DAF2E26AD3A971973C5
                                                                                                                                                                                                                                                      SHA-512:65DC3F32FAF30E62DFDECB72775DF870AF4C3A32A0BF576ED1AAAE4B16AC6897B62B19E01DC2BF46F46FBE3F475C061F79CBE987EDA583FEE1817070779860E5
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                      Joe Sandbox View:
                                                                                                                                                                                                                                                      • Filename: wp-cent.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                      • Filename: wp-cent.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                      • Filename: WTvNL75dCr.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                      • Filename: WTvNL75dCr.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                      • Filename: FileScanner.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                      • Filename: MacAttack.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                      • Filename: download.ps1, Detection: malicious, Browse
                                                                                                                                                                                                                                                      • Filename: y3x8pjQ1Ci.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........LS..-=..-=..-=.....-=..U...-=..-<.k-=.gB<..-=.gB9..-=.gB>..-=.gB8.=-=.gB=..-=.gB..-=.gB?..-=.Rich.-=.........PE..d.....t^.........." .....@..........."...............................................z....`A.........................................j..h....D..,...............L;...... A......(...@...8...............................0............P.......f..@....................text...,>.......@.................. ..`.rdata..r....P.......D..............@..@.data....:...`..."...N..............@....pdata..L;.......<...p..............@..@.didat..h...........................@....rsrc...............................@..@.reloc..(...........................@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\bin\MSVCP140_1.dll

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):31728
                                                                                                                                                                                                                                                      Entropy (8bit):6.499754548353504
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:384:rOY/H1SbuIqnX8ndnWc95gW3C8c+pBj0HRN7bULkcyHRN7rxTO6iuQl9xiv:yYIBqnMdxxWd4urv
                                                                                                                                                                                                                                                      MD5:0FE6D52EB94C848FE258DC0EC9FF4C11
                                                                                                                                                                                                                                                      SHA1:95CC74C64AB80785F3893D61A73B8A958D24DA29
                                                                                                                                                                                                                                                      SHA-256:446C48C1224C289BD3080087FE15D6759416D64F4136ADDF30086ABD5415D83F
                                                                                                                                                                                                                                                      SHA-512:C39A134210E314627B0F2072F4FFC9B2CE060D44D3365D11D8C1FE908B3B9403EBDD6F33E67D556BD052338D0ED3D5F16B54D628E8290FD3A155F55D36019A86
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......>.{.zl..zl..zl......xl..s...~l.....}l.....xl..zl..Ql......l.....il.....{l.....{l.....{l..Richzl..................PE..d.....t^.........." .........$......p.....................................................`A........................................p>..L....?..x....p.......`..X....:...A......p...P3..8............................3..0............0..@............................text............................... ..`.rdata.......0......................@..@.data........P.......,..............@....pdata..X....`.......0..............@..@.rsrc........p.......4..............@..@.reloc..p............8..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\bin\Qt5Core.dll

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):6023664
                                                                                                                                                                                                                                                      Entropy (8bit):6.768988071491288
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:98304:hcirJylHYab/6bMJsv6tWKFdu9CLiZxqfg8gwf:+irJylHFb/QMJsv6tWKFdu9CL4xqfg8x
                                                                                                                                                                                                                                                      MD5:817520432A42EFA345B2D97F5C24510E
                                                                                                                                                                                                                                                      SHA1:FEA7B9C61569D7E76AF5EFFD726B7FF6147961E5
                                                                                                                                                                                                                                                      SHA-256:8D2FF4CE9096DDCCC4F4CD62C2E41FC854CFD1B0D6E8D296645A7F5FD4AE565A
                                                                                                                                                                                                                                                      SHA-512:8673B26EC5421FCE8E23ADF720DE5690673BB4CE6116CB44EBCC61BBBEF12C0AD286DFD675EDBED5D8D000EFD7609C81AAE4533180CF4EC9CD5316E7028F7441
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                      Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......D.............................UJ......................................................W.....,..................r....................Rich............PE..d...;._.........." ..........-.......-......................................`\.....x.\...`...........................................L..O....T...... \.......U.. ....[......0\..%..,.H.T.....................H.(.....H.0............./.H............................text............................... ..`.rdata..F7%.../..8%.................@..@.data...x....PT..\...6T.............@....pdata... ....U.."....T.............@..@.qtmimed.....0W.......V.............@..P.rsrc........ \.......[.............@..@.reloc...%...0\..&....[.............@..B........................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\bin\Qt5DBus.dll

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):436720
                                                                                                                                                                                                                                                      Entropy (8bit):6.392610185061176
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:6144:ZLvnUJ17UTGOkWHUe/W9TgYMDu96ixMZQ8IlXbKgp8aIDeN:KP7cGOGegTwu96ixMZQtlrPN
                                                                                                                                                                                                                                                      MD5:0E8FF02D971B61B5D2DD1AC4DF01AE4A
                                                                                                                                                                                                                                                      SHA1:638F0B46730884FA036900649F69F3021557E2FE
                                                                                                                                                                                                                                                      SHA-256:1AA70B106A10C86946E23CAA9FC752DC16E29FBE803BBA1F1AB30D1C63EE852A
                                                                                                                                                                                                                                                      SHA-512:7BA616EDE66B16D9F8B2A56C3117DB49A74D59D0D32EAA6958DE57EAC78F14B1C7F2DBBA9EAE4D77937399CF14D44535531BAF6F9DB16F357F8712DFAAE4346A
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........D..*..*..*.....*...+..*.../..*.......*...)..*...+..*.O.+..*..+...*.O./..*.O.*..*.O....*.....*.O.(..*.Rich.*.........................PE..d...]._.........." .....\...<.......\..............................................K.....`..........................................h..to...................`...Q..............4.......T.......................(...`...0............p...............................text...yZ.......\.................. ..`.rdata..0....p.......`..............@..@.data...X....@......."..............@....pdata...Q...`...R...2..............@..@.rsrc...............................@..@.reloc..4...........................@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\bin\Qt5Gui.dll

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):7008240
                                                                                                                                                                                                                                                      Entropy (8bit):6.674290383197779
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:49152:9VPhJZWVvpg+za3cFlc61j2VjBW77I4iNlmLPycNRncuUx24LLsXZFC6FOCfDt2/:BJZzI1ZR3U9Cxc22aDACInVc4Z
                                                                                                                                                                                                                                                      MD5:47307A1E2E9987AB422F09771D590FF1
                                                                                                                                                                                                                                                      SHA1:0DFC3A947E56C749A75F921F4A850A3DCBF04248
                                                                                                                                                                                                                                                      SHA-256:5E7D2D41B8B92A880E83B8CC0CA173F5DA61218604186196787EE1600956BE1E
                                                                                                                                                                                                                                                      SHA-512:21B1C133334C7CA7BBBE4F00A689C580FF80005749DA1AA453CCEB293F1AD99F459CA954F54E93B249D406AEA038AD3D44D667899B73014F884AFDBD9C461C14
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                      Preview:MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.......QH^~.)0-.)0-.)0-.Q.-.)0-...-.)0-.F4,.)0-.F3,.)0-.F5,.)0-.F1,.)0-.Y1,.)0-.B5,.)0-.B1,.)0-.)1-m,0-.Y4,.)0-.Y5,|(0-.Y0,.)0-.Y.-.)0-.).-.)0-.Y2,.)0-Rich.)0-................PE..d....._.........." ......?...+.....X.?.......................................k.....R.k...`.........................................pKK.....d.e.|....`k.......g.......j......pk..6....F.T................... .F.(.....F.0.............?.p+...........................text...2.?.......?................. ..`.rdata...z&...?..|&...?.............@..@.data....o... f.......f.............@....pdata........g.......f.............@..@.rsrc........`k.......j.............@..@.reloc...6...pk..8....j.............@..B........................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\bin\Qt5Network.dll

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):1340400
                                                                                                                                                                                                                                                      Entropy (8bit):6.41486755163134
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:24576:eXPn73RXox1U9M0m+1ffSDY565RzHUY1iaRy95hdGehEM:+7hXU1U95m4ff9A5RviaRy9NGI
                                                                                                                                                                                                                                                      MD5:3569693D5BAE82854DE1D88F86C33184
                                                                                                                                                                                                                                                      SHA1:1A6084ACFD2AA4D32CEDFB7D9023F60EB14E1771
                                                                                                                                                                                                                                                      SHA-256:4EF341AE9302E793878020F0740B09B0F31CB380408A697F75C69FDBD20FC7A1
                                                                                                                                                                                                                                                      SHA-512:E5EFF4A79E1BDAE28A6CA0DA116245A9919023560750FC4A087CDCD0AB969C2F0EEEC63BBEC2CD5222D6824A01DD27D2A8E6684A48202EA733F9BB2FAB048B32
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                      Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.........Yt..7'..7'..7'...'..7'..3&..7'}.3&..7'}.4&..7'}.2&..7'}.6&..7'..6&..7'0.6&..7'..6'c.7'0.2&2.7'0.7&..7'0..'..7'...'..7'0.5&..7'Rich..7'........................PE..d....._.........." .................................................................c....`......................................... ....n..,...h....................X..........,.......T...................p...(...@...0............................................text...C........................... ..`.rdata...g.......h..................@..@.data...XN...@...2... ..............@....pdata...............R..............@..@.rsrc................>..............@..@.reloc..,............D..............@..B................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\bin\Qt5Qml.dll

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):3591664
                                                                                                                                                                                                                                                      Entropy (8bit):6.333693598000157
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:98304:iPnt09+kVh2NrSdSG779LLLS/o/L4YqoY0Xba+mRRH2T:iPnt2ZVhT
                                                                                                                                                                                                                                                      MD5:D055566B5168D7B1D4E307C41CE47C4B
                                                                                                                                                                                                                                                      SHA1:043C0056E9951DA79EC94A66A784972532DC18EF
                                                                                                                                                                                                                                                      SHA-256:30035484C81590976627F8FACE9507CAA8581A7DC7630CCCF6A8D6DE65CAB707
                                                                                                                                                                                                                                                      SHA-512:4F12D17AA8A3008CAA3DDD0E41D3ED713A24F9B5A465EE93B2E4BECCF876D5BDF0259AA0D2DD77AD61BB59DC871F78937FFBE4D0F60638014E8EA8A27CAF228D
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......W.4...Z...Z...Z......Z..^...Z..Y...Z.._...Z..[...Z...[...Z...[...Z...[...Z..._...Z...Z...Z.......Z......Z...X...Z.Rich..Z.........PE..d......_.........." .....^$..........O$.......................................7.....}.7...`...........................................,......2.......6.......4. .....6.......6..J....).T.....................).(...p.).0............p$..%...........................text....\$......^$................. ..`.rdata......p$......b$.............@..@.data.........3..n....2.............@....pdata.. .....4......l4.............@..@.rsrc.........6......`6.............@..@.reloc...J....6..L...f6.............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\bin\Qt5QmlModels.dll

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):438768
                                                                                                                                                                                                                                                      Entropy (8bit):6.312090336793804
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:6144:k1tE6lq982HdyuEZ5gw+VHDZjZ0yOWm7Vdcm4GyasLCZCu6vdQp:k1tEuq9Hdyuo5gwguyOtVIup
                                                                                                                                                                                                                                                      MD5:2030C4177B499E6118BE5B9E5761FCE1
                                                                                                                                                                                                                                                      SHA1:050D0E67C4AA890C80F46CF615431004F2F4F8FC
                                                                                                                                                                                                                                                      SHA-256:51E4E5A5E91F78774C44F69B599FAE4735277EF2918F7061778615CB5C4F6E81
                                                                                                                                                                                                                                                      SHA-512:488F7D5D9D8DEEE9BBB9D63DAE346E46EFEB62456279F388B323777999B597C2D5AEA0EE379BDF94C9CBCFD3367D344FB6B5E90AC40BE2CE95EFA5BBDD363BCC
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......x..<...<...<...5.H.4...(...>.......*.......4.......8.......8......9...<...g....../......=....$.=...<.L.=......=...Rich<...................PE..d...M.._.........." .....(...r......d+..............................................MF....`.........................................0E...^..0................`.. F..................H...T.......................(.......0............@...............................text...N&.......(.................. ..`.rdata.......@.......,..............@..@.data...x/...0...(..................@....pdata.. F...`...H...>..............@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\bin\Qt5Quick.dll

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):4148720
                                                                                                                                                                                                                                                      Entropy (8bit):6.462183686222023
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:49152:EcDwCQsvkBD+ClI3IAVLA7Tr15SokomoqxQhT2bAssCFEUGX5ig:E7CKPsA3p0Z/QV/sS3Ag
                                                                                                                                                                                                                                                      MD5:65F59CFC0C1C060CE20D3B9CEFFBAF46
                                                                                                                                                                                                                                                      SHA1:CFD56D77506CD8C0671CA559D659DAB39E4AD3C2
                                                                                                                                                                                                                                                      SHA-256:C81AD3C1111544064B1830C6F1AEF3C1FD13B401546AB3B852D697C0F4D854B3
                                                                                                                                                                                                                                                      SHA-512:D6F6DC19F1A0495026CBA765B5A2414B6AF0DBFC37B5ACEED1CD0AE37B3B0F574B759A176D75B01EDD74C6CE9A3642D3D29A3FD7F166B53A41C8978F562B4B50
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......!Fvge'.4e'.4e'.4l_.4i'.4.H.5m'.4.H.5a'.4.H.5|'.4.H.5c'.4.W.5o'.4qL.5`'.4e'.4.,.4.W.5.'.4.W.5d'.4.W.4d'.4e'.4d'.4.W.5d'.4Riche'.4........................PE..d......_.........." ......%..B......L.$.......................................?.......?...`.........................................0)2.P.....8.T.....>.......<..^...2?.......?.py......T.......................(.......0............ %..\...........................text.....%.......%................. ..`.rdata....... %.......%.............@..@.data....I...@;..2... ;.............@....pdata...^....<..`...R<.............@..@.rsrc.........>.......>.............@..@.reloc..py....?..z....>.............@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\bin\Qt5Svg.dll

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):330736
                                                                                                                                                                                                                                                      Entropy (8bit):6.381828869454302
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:6144:6qLZcTC3wR/0JNZ+csBkBv0L0hq+SvcO8MsvwbIeblsjTR:6qNcCwqHE2fYlsPR
                                                                                                                                                                                                                                                      MD5:03761F923E52A7269A6E3A7452F6BE93
                                                                                                                                                                                                                                                      SHA1:2CE53C424336BCC8047E10FA79CE9BCE14059C50
                                                                                                                                                                                                                                                      SHA-256:7348CFC6444438B8845FB3F59381227325D40CA2187D463E82FC7B8E93E38DB5
                                                                                                                                                                                                                                                      SHA-512:DE0FF8EBFFC62AF279E239722E6EEDD0B46BC213E21D0A687572BFB92AE1A1E4219322233224CA8B7211FFEF52D26CB9FE171D175D2390E3B3E6710BBDA010CB
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............_._._..*_._,.^._..^._,.^._,.^._,.^._a.^._._=.._a.^._a.^._a.F_._.._._a.^._Rich._................PE..d......_.........." .........................................................@.......^....`.................................................((....... ...........0...........0..H...xL..T....................N..(....L..0............................................text............................... ..`.rdata..p...........................@..@.data...8...........................@....pdata...0.......2..................@..@.rsrc........ ......................@..@.reloc..H....0......................@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\bin\Qt5WebSockets.dll

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):149488
                                                                                                                                                                                                                                                      Entropy (8bit):6.116105454277536
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:3072:4sSkET6pEXb3loojg1Q2sorWvZXF2sorrLA7cG27Qhvvc:4sSd6pwzloDbsnX0sCrc7ct7QVc
                                                                                                                                                                                                                                                      MD5:A016545F963548E0F37885E07EF945C7
                                                                                                                                                                                                                                                      SHA1:CBE499E53AB0BD2DA21018F4E2092E33560C846F
                                                                                                                                                                                                                                                      SHA-256:6B56F77DA6F17880A42D2F9D2EC8B426248F7AB2196A0F55D37ADE39E3878BC6
                                                                                                                                                                                                                                                      SHA-512:47A3C965593B97392F8995C7B80394E5368D735D4C77F610AFD61367FFE7658A0E83A0DBD19962C4FA864D94F245A9185A915010AFA23467F999C833982654C2
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........'`.CF.KCF.KCF.KJ>.KGF.K.).JAF.KW-.JAF.K.).JVF.K.).JKF.K.).J@F.K.6.JFF.KCF.K.G.K.6.JPF.K.6.JBF.K.6.KBF.KCF.KBF.K.6.JBF.KRichCF.K........................PE..d......_.........." .....$..........t(.......................................p.......5....`............................................."..l........P.......0.......,.......`..L...hw..T....................x..(....w..0............@...............................text....".......$.................. ..`.rdata..z....@.......(..............@..@.data...x...........................@....pdata.......0......................@..@.rsrc........P......."..............@..@.reloc..L....`.......(..............@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\bin\Qt5Widgets.dll

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):5498352
                                                                                                                                                                                                                                                      Entropy (8bit):6.619117060971844
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:49152:KO+LIFYAPZtMym9RRQ7/KKIXSewIa/2Xqq1sfeOoKGOh6EwNmiHYYwBrK8KMlH0p:IGoKZdRqJD10rK8KMlH0gi5GX0oKZ
                                                                                                                                                                                                                                                      MD5:4CD1F8FDCD617932DB131C3688845EA8
                                                                                                                                                                                                                                                      SHA1:B090ED884B07D2D98747141AEFD25590B8B254F9
                                                                                                                                                                                                                                                      SHA-256:3788C669D4B645E5A576DE9FC77FCA776BF516D43C89143DC2CA28291BA14358
                                                                                                                                                                                                                                                      SHA-512:7D47D2661BF8FAC937F0D168036652B7CFE0D749B571D9773A5446C512C58EE6BB081FEC817181A90F4543EBC2367C7F8881FF7F80908AA48A7F6BB261F1D199
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........x..................I.......I.......I.......I...........................................9.................................Rich............PE..d....._.........." ......3..P .......3.......................................T......MT...`.........................................0.D.P^....L.h....pS......0P..8....S.......S.d.....?.T...................`.?.(...0.?.0.............3.._...........................text.....3.......3................. ..`.rdata..8.....3.......3.............@..@.data.........O......dO.............@....pdata...8...0P..:....O.............@..@.rsrc........pS......4S.............@..@.reloc..d.....S......:S.............@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\bin\VCRUNTIME140.dll

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):101872
                                                                                                                                                                                                                                                      Entropy (8bit):6.5661918084228725
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:1536:RCKWZGuEK0mOLSTxoPl9GIcuZrxi4hXX9oix8H+NCIecbGShwZul:RFWY1WxgGStJ8H2CIecbG36
                                                                                                                                                                                                                                                      MD5:971DBBE854FC6AB78C095607DFAD7B5C
                                                                                                                                                                                                                                                      SHA1:1731FB947CD85F9017A95FDA1DC5E3B0F6B42CA2
                                                                                                                                                                                                                                                      SHA-256:5E197A086B6A7711BAA09AFE4EA7C68F0E777B2FF33F1DF25A21F375B7D9693A
                                                                                                                                                                                                                                                      SHA-512:B966AAB9C0D9459FADA3E5E96998292D6874A7078924EA2C171F0A1A50B0784C24CC408D00852BEC48D6A01E67E41D017684631176D3E90151EC692161F1814D
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........w.............t:..............................................................Rich....................PE..d.....t^.........." .........^.......................................................e....`A.........................................0..4....9.......p.......P.......L...A..............8........................... ...0............................................text...2........................... ..`.rdata...?.......@..................@..@.data...0....@.......4..............@....pdata.......P.......8..............@..@_RDATA.......`.......D..............@..@.rsrc........p.......F..............@..@.reloc...............J..............@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\bin\VCRUNTIME140_1.dll

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):44528
                                                                                                                                                                                                                                                      Entropy (8bit):6.627837381503075
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:384:Aim/NRETi8kykt25HwviU5fJUiP2551xWmbTqOA7SXf+Ny85xM8ATJWr3KWoC8cS:0Ie8kySL2iPQxdvjAevcMESW5lxJG
                                                                                                                                                                                                                                                      MD5:6BC084255A5E9EB8DF2BCD75B4CD0777
                                                                                                                                                                                                                                                      SHA1:CF071AD4E512CD934028F005CABE06384A3954B6
                                                                                                                                                                                                                                                      SHA-256:1F0F5F2CE671E0F68CF96176721DF0E5E6F527C8CA9CFA98AA875B5A3816D460
                                                                                                                                                                                                                                                      SHA-512:B822538494D13BDA947655AF791FED4DAA811F20C4B63A45246C8F3BEFA3EC37FF1AA79246C89174FE35D76FFB636FA228AFA4BDA0BD6D2C41D01228B151FD89
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........ .S.A...A...A..0.m..A..O....A...9...A...A...A..O....A..O....A..O....A..O....A..O.}..A..O....A..Rich.A..................PE..d.....t^.........." .....:...4......pA...............................................Z....`A.........................................j......|k..x....................l...A......8....b..8...........................@b..0............P..X............................text....9.......:.................. ..`.rdata... ...P..."...>..............@..@.data................`..............@....pdata...............b..............@..@.rsrc................f..............@..@.reloc..8............j..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\bin\d3dcompiler_47.dll

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):4173928
                                                                                                                                                                                                                                                      Entropy (8bit):6.329102290474506
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:49152:8BfmqCtLI4erBYysLjG/A8McPyCD6hw16JVTW7B3EgvVlQ3LAYmyNOvGJse+aWyb:8eZevVKACOvWYQF
                                                                                                                                                                                                                                                      MD5:B0AE3AA9DD1EBD60BDF51CB94834CD04
                                                                                                                                                                                                                                                      SHA1:EE2F5726AC140FB42D17ABA033D678AFAF8C39C1
                                                                                                                                                                                                                                                      SHA-256:E994847E01A6F1E4CBDC5A864616AC262F67EE4F14DB194984661A8D927AB7F4
                                                                                                                                                                                                                                                      SHA-512:756EBF4FA49029D4343D1BDB86EA71B2D49E20ADA6370FD7582515455635C73D37AD0DBDEEF456A10AB353A12412BA827CA4D70080743C86C3B42FA0A3152AA3
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 3%
                                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......G..(.a.{.a.{.a.{..m{5a.{..l{.a.{.m{.a.{.o{.a.{.a.{.a.{.i{.a.{.l{.a.{.h{.a.{.q{.a.{.k{.a.{.n{.a.{Rich.a.{........................PE..d......R.........." ......;.........`.8......................................@@......a@...`...........................................;.u...P.>.d.....?.@.....=......t?.h<... ?..{..................................@a................>.P............................text.....;.......;................. ..`.data...h.....;.......;.............@....pdata........=......n<.............@..@.idata..@.....>......B>.............@..@.rsrc...@.....?......\>.............@..@.reloc....... ?......b>.............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\bin\libEGL.dll

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):25072
                                                                                                                                                                                                                                                      Entropy (8bit):5.961464514165753
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:384:KEyYvsyDQrjwgut4Maw+XZndDGg7Dgf2hU:RvszjwgocwOhdDGEUf2hU
                                                                                                                                                                                                                                                      MD5:BB00EF1DD81296AF10FDFA673B4D1397
                                                                                                                                                                                                                                                      SHA1:773FFCF4A231B963BAAC36CBEF68079C09B62837
                                                                                                                                                                                                                                                      SHA-256:32092DE077FD57B6EF355705EC46C6D21F6D72FBE3D3A5DD628F2A29185A96FA
                                                                                                                                                                                                                                                      SHA-512:C87C0868C04852B63A7399AFE4E568CD9A65B7B7D5FD63030ABEA649AAC5E9F2293AB5BE2B2CE56A57F2B4B1992AE730150A293ADA53637FC5CD7BE0A727CBD4
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........9...Xv@.Xv@.Xv@. .@.Xv@.7wA.Xv@.3wA.Xv@.7sA.Xv@.7rA.Xv@.7uA.Xv@W(wA.Xv@.Xw@.Xv@W(sA.Xv@W(vA.Xv@W(.@.Xv@.X.@.Xv@W(tA.Xv@Rich.Xv@........PE..d...#._.........." .........0......................................................Z.....`.........................................`9.......B..d.......H....p.......F.......... ....3..T............................4..0............0...............................text............................... ..`.rdata..r#...0...$..................@..@.data........`.......:..............@....pdata.......p.......<..............@..@.rsrc...H............>..............@..@.reloc.. ............D..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\bin\libGLESv2.dll

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):3385328
                                                                                                                                                                                                                                                      Entropy (8bit):6.382356347494905
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:49152:sU0O89Onk/cNTgO/WSLqfTPnK+9eaOiY95ZEQryD1pPG3L:MaHUKt3L
                                                                                                                                                                                                                                                      MD5:2247EE4356666335DF7D72129AF8D600
                                                                                                                                                                                                                                                      SHA1:F0131C1A67FC17C0E8DCC4A4CA38C9F1780E7182
                                                                                                                                                                                                                                                      SHA-256:50FAD5605B3D57627848B3B84A744DFB6A045609B8236B04124F2234676758D8
                                                                                                                                                                                                                                                      SHA-512:67F2A7BF169C7B9A516689CF1B16446CA50E57F099B9B742CCB1ABB2DCDE8867F8F6305AD8842CD96194687FC314715AE04C1942B0E0A4F51B592B028C5B16D3
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............t..t..t....t.A.p..t.A.w..t.A.q..t.A.u..t.u..t..u..t...q..t...t..t......t.....t...v..t.Rich..t.........PE..d....._.........." ......&.........L.&.......................................3.......3...`..........................................0..]....0.......3.P.....1.L.....3.......3..;...},.T...................P.,.(... ~,.0.............'..............................text...o.&.......&................. ..`.rdata........'.......&.............@..@.data.........1.......0.............@....pdata..L.....1.......1.............@..@.rsrc...P.....3......J3.............@..@.reloc...;....3..<...P3.............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\bin\opengl32sw.dll

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):20923392
                                                                                                                                                                                                                                                      Entropy (8bit):6.255903817217008
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:393216:LIckHor5uLnn83wAP5hxOZEa7/LzRuDFqILn5LgcKyZyQXt+8M:yEZbv
                                                                                                                                                                                                                                                      MD5:7DBC97BFEE0C7AC89DA8D0C770C977B6
                                                                                                                                                                                                                                                      SHA1:A064C8D8967AAA4ADA29BD9FEFBE40405360412C
                                                                                                                                                                                                                                                      SHA-256:963641A718F9CAE2705D5299EAE9B7444E84E72AB3BEF96A691510DD05FA1DA4
                                                                                                                                                                                                                                                      SHA-512:286997501E1F5CE236C041DCB1A225B4E01C0F7C523C18E9835507A15C0AC53C4D50F74F94822125A7851FE2CB2FB72F84311A2259A5A50DCE6F56BA05D1D7E8
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......[.@..............'.......'.......'..[...........|.-.....|.+.*...|.*.<....'......../.....q.*.....q.+....q.&.^...q.......q.,.....Rich............PE..d....._W.........." .....(....b.....|&....................................... E...........`.........................................0.1.t.....1...............9.`n............C..k.. . .T..................... .(..... ..............@...............................text...T&.......(.................. ..`.rdata..XvO..@...xO..,..............@..@.data....;....1.......1.............@....pdata..`n....9..p...D3.............@..@.gfids.......pC.......=.............@..@.tls..........C.......=.............@..._RDATA........C.......=.............@..@.reloc...k....C..l....=.............@..B................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\plugins\generic\qtuiotouchplugin.dll

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):68080
                                                                                                                                                                                                                                                      Entropy (8bit):6.207162014262433
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:1536:mQ4IT53ign4CbtlO705xWL3frA5rlhgQJ7tapgUff:mLIT53Hbtk70OLs3hg0Cz
                                                                                                                                                                                                                                                      MD5:750A31DE7840B5EED8BA14C1BD84D348
                                                                                                                                                                                                                                                      SHA1:D345D13B0C303B7094D1C438E49F0046791DE7F6
                                                                                                                                                                                                                                                      SHA-256:A9BFFB0F3CD69CD775C328C916E46440FE80D99119FAEBC350C7EC51E3E57C41
                                                                                                                                                                                                                                                      SHA-512:5C0A68ED27A9F1BBFF104942152E475C94BB64B03CE252EAAC1A6770E24DC4156CE4ADE99EBCD92662801262DED892C33F84C605AD84472B45A83C4883D5E767
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............h..h..h...s.h..]...h.....h..]...h..]...h..]...h......h..h..&h......h......h......h......h..Rich.h..................PE..d...X._.........." .........b......$........................................@......{v....`......................................... ................ ..X....................0......H...T......................(.......0............................................text............................... ..`.rdata...E.......F..................@..@.data...............................@....pdata..............................@..@.qtmetadi...........................@..P.rsrc...X.... ......................@..@.reloc.......0......................@..B................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\plugins\iconengines\qsvgicon.dll

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):41968
                                                                                                                                                                                                                                                      Entropy (8bit):6.0993566622860635
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:768:VPs5g31JfDgej5JZmA0ZsEEC6lmn+4FdDGimUf2hr:VkC31ee7ZmA+sEEC6lmn+4FOUfc
                                                                                                                                                                                                                                                      MD5:313F89994F3FEA8F67A48EE13359F4BA
                                                                                                                                                                                                                                                      SHA1:8C7D4509A0CAA1164CC9415F44735B885A2F3270
                                                                                                                                                                                                                                                      SHA-256:42DDE60BEFCF1D9F96B8366A9988626B97D7D0D829EBEA32F756D6ECD9EA99A8
                                                                                                                                                                                                                                                      SHA-512:06E5026F5DB929F242104A503F0D501A9C1DC92973DD0E91D2DAF5B277D190082DE8D37ACE7EDF643C70AA98BB3D670DEFE04CE89B483DA4F34E629F8ED5FECF
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......n.:*..i*..i*..i#.Ei...i...h(..i>..h(..i...h8..i...h-..i...h(..i...h-..i*..i...i...h(..i...h+..i..)i+..i...h+..iRich*..i........................PE..d......_.........." .....@...F.......F..............................................C.....`..........................................g..x...hh..........H...........................xX..T....................Z..(....X..0............P...............................text....>.......@.................. ..`.rdata...3...P...4...D..............@..@.data................x..............@....pdata...............z..............@..@.qtmetadj...........................@..P.rsrc...H...........................@..@.reloc..............................@..B........................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\plugins\imageformats\qgif.dll

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):39408
                                                                                                                                                                                                                                                      Entropy (8bit):6.0316011626259405
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:768:ygk2hM0GskFtvPCjEIxh8eDzFyPddeeGvnhotdDGPUf2he:yN2a05kfPOEMaeDzFkddeFnhotOUfh
                                                                                                                                                                                                                                                      MD5:52FD90E34FE8DED8E197B532BD622EF7
                                                                                                                                                                                                                                                      SHA1:834E280E00BAE48A9E509A7DC909BEA3169BDCE2
                                                                                                                                                                                                                                                      SHA-256:36174DD4C5F37C5F065C7A26E0AC65C4C3A41FDC0416882AF856A23A5D03BB9D
                                                                                                                                                                                                                                                      SHA-512:EF3FB3770808B3690C11A18316B0C1C56C80198C1B1910E8AA198DF8281BA4E13DC9A6179BB93A379AD849304F6BB934F23E6BBD3D258B274CC31856DE0FC12B
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........R...3..3..3..KA.3..o\..3..X..3..o\..3..o\..3..o\..3.."C..3..3...3.."C..3.."C..3.."C-.3.."C..3..Rich.3..........PE..d...H._.........." .....@...B.......E...............................................^....`..........................................f..t....f..........@............~..............HW..T....................X..(....W..0............P...............................text...k?.......@.................. ..`.rdata..&)...P...*...D..............@..@.data...(............n..............@....pdata...............p..............@..@.qtmetads............v..............@..P.rsrc...@............x..............@..@.reloc...............|..............@..B........................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\plugins\imageformats\qicns.dll

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):45040
                                                                                                                                                                                                                                                      Entropy (8bit):6.016125225197622
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:768:vEip0IlhxTDxut3dnm8IyAmQQ3ydJouEAkNypTAO0tfC3apmsdDG9Uf2hU:vxvXxgVIyA23ydJlEATpTAO0tfCKpms/
                                                                                                                                                                                                                                                      MD5:AD84AF4D585643FF94BFA6DE672B3284
                                                                                                                                                                                                                                                      SHA1:5D2DF51028FBEB7F6B52C02ADD702BC3FA781E08
                                                                                                                                                                                                                                                      SHA-256:F4A229A082D16F80016F366156A2B951550F1E9DF6D4177323BBEDD92A429909
                                                                                                                                                                                                                                                      SHA-512:B68D83A4A1928EB3390DEB9340CB27B8A3EB221C2E0BE86211EF318B4DD34B37531CA347C73CCE79A640C5B06FBD325E10F8C37E0CEE2581F22ABFBFF5CC0D55
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..................a....Q........Q......Q......Q......................................Rich...........PE..d......_.........." .....B...N.......G...............................................&....`.............................................t...$...........@...........................xp..T....................r..(....p..0............`...............................text....@.......B.................. ..`.rdata...9...`...:...F..............@..@.data...............................@....pdata..............................@..@.qtmetadx...........................@..P.rsrc...@...........................@..@.reloc..............................@..B........................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\plugins\imageformats\qico.dll

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):38384
                                                                                                                                                                                                                                                      Entropy (8bit):5.957072398645384
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:768:zBXBEfQiAzC9Oh5AS7a3Z5OGrTDeV9mp7nnsWdDGgYUf2hi/:8JAzuOhy3zOGrTDeV9mp7nnsWjYUfz
                                                                                                                                                                                                                                                      MD5:A9ABD4329CA364D4F430EDDCB471BE59
                                                                                                                                                                                                                                                      SHA1:C00A629419509929507A05AEBB706562C837E337
                                                                                                                                                                                                                                                      SHA-256:1982A635DB9652304131C9C6FF9A693E70241600D2EF22B354962AA37997DE0B
                                                                                                                                                                                                                                                      SHA-512:004EA8AE07C1A18B0B461A069409E4061D90401C8555DD23DBF164A08E96732F7126305134BFAF8B65B0406315F218E05B5F0F00BEDB840FB993D648CE996756
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........u.G...G...G...N...C......E...S...E......R......O......D.......B...G...........D.......F.......F.......F...RichG...................PE..d...H._.........." .....4...H.......9....................................................`..........................................h..t...th..........@............z..............(X..T....................Y..(....X..0............P..8............................text....2.......4.................. ..`.rdata..B/...P...0...8..............@..@.data...h............h..............@....pdata...............l..............@..@.qtmetad.............r..............@..P.rsrc...@............t..............@..@.reloc...............x..............@..B................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\plugins\imageformats\qjpeg.dll

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):421360
                                                                                                                                                                                                                                                      Entropy (8bit):5.7491063936821405
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:6144:USgOWz1eW38u9tyh6fpGUasBKTrsXWwMmH1l3JM5hn0uEfB4:USPQTnastBRB4
                                                                                                                                                                                                                                                      MD5:16ABCCEB70BA20E73858E8F1912C05CD
                                                                                                                                                                                                                                                      SHA1:4B3A32B166AB5BBBEE229790FDAE9CBC84F936BA
                                                                                                                                                                                                                                                      SHA-256:FB4E980CB5FAFA8A4CD4239329AED93F7C32ED939C94B61FB2DF657F3C6AD158
                                                                                                                                                                                                                                                      SHA-512:3E5C83967BF31C9B7F1720059DD51AA4338E518B076B0461541C781B076135E9CB9CBCEB13A8EC9217104517FBCC356BDD3FFACA7956D1C939E43988151F6273
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Iv"...L...L...L..o....L..xM...L..|M...L.......L..xI...L..xH...L..xO...L..gM...L...M...L..gH.?.L..gI...L..gL...L..g....L..gN...L.Rich..L.........PE..d...o._.........." .....b...........i...............................................g....`.............................................t...............@....`.......R..............h...T.......................(.......0...............@............................text....`.......b.................. ..`.rdata..J............f..............@..@.data...8....P.......(..............@....pdata.......`... ...*..............@..@.qtmetad.............J..............@..P.rsrc...@............L..............@..@.reloc...............P..............@..B........................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\plugins\imageformats\qsvg.dll

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):32240
                                                                                                                                                                                                                                                      Entropy (8bit):5.978149408776758
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:768:uOVKDlJJVlTuLiMtsKVG7TSdDG9Uf2h4e:hVgJVlTuL/tsKVG7TSQUfre
                                                                                                                                                                                                                                                      MD5:C0DE135782FA0235A0EA8E97898EAF2A
                                                                                                                                                                                                                                                      SHA1:FCF5FD99239BF4E0B17B128B0EBEC144C7A17DE2
                                                                                                                                                                                                                                                      SHA-256:B3498F0A10AC4CB42CF7213DB4944A34594FF36C78C50A0F249C9085D1B1FF39
                                                                                                                                                                                                                                                      SHA-512:7BD5F90CCAB3CF50C55EAF14F7EF21E05D3C893FA7AC9846C6CA98D6E6D177263AC5EB8A85A34501BCFCA0DA7F0B6C39769726F4090FCA2231EE64869B81CF0B
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........x>...P...P...P..a...P.&vQ...P..rQ...P.&vU...P.&vT...P.&vS...P.kiQ...P...Q.n.P.kiU...P.kiP...P.ki....P.kiR...P.Rich..P.........PE..d......_.........." .....$...B......D)....................................................`.........................................PU..t....U..........@............b...............G..T....................I..(...PH..0............@..(............................text....".......$.................. ..`.rdata...+...@...,...(..............@..@.data...8....p.......T..............@....pdata...............V..............@..@.qtmetad.............Z..............@..P.rsrc...@............\..............@..@.reloc...............`..............@..B........................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\plugins\imageformats\qtga.dll

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):31728
                                                                                                                                                                                                                                                      Entropy (8bit):5.865766652452823
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:768:1lGALluUEAQATWQ79Z2Y8Ar+dDG2vUf2hF:TZl/EH8WQ794Y8Ar+hvUfm
                                                                                                                                                                                                                                                      MD5:A913276FA25D2E6FD999940454C23093
                                                                                                                                                                                                                                                      SHA1:785B7BC7110218EC0E659C0E5ACE9520AA451615
                                                                                                                                                                                                                                                      SHA-256:5B641DEC81AEC1CF7AC0CCE9FC067BB642FBD32DA138A36E3BDAC3BB5B36C37A
                                                                                                                                                                                                                                                      SHA-512:CEBE48E6E6C5CDF8FC339560751813B8DE11D2471A3DAB7D648DF5B313D85735889D4E704E8EEC0AD1084AB43BE0EBDFBACD038AEAC46D7A951EFB3A7CE838EB
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........F ._'N._'N._'N.V_.Y'N..HO.]'N.KLO.]'N..HK.M'N..HJ.W'N..HM.\'N..WO.Z'N._'O.4'N..WK.\'N..WN.^'N..W..^'N..WL.^'N.Rich_'N.........................PE..d......_.........." ....."...@.......'..............................................7.....`..........................................W..t...dX..........@.......`....`..............(I..T....................J..(....I..0............@..h............................text...[!.......".................. ..`.rdata...)...@...*...&..............@..@.data........p.......P..............@....pdata..`............T..............@..@.qtmetadu............X..............@..P.rsrc...@............Z..............@..@.reloc...............^..............@..B........................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\plugins\imageformats\qtiff.dll

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):390128
                                                                                                                                                                                                                                                      Entropy (8bit):5.724665470266677
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:6144:V0jqHiFBaRe0GPAKwP15e7xrEEEEEEN024Rx/3tkYiHUASQbs/l7OanYoOgyV:0qqwP15bx/q7/yyV
                                                                                                                                                                                                                                                      MD5:9C0ACF12D3D25384868DCD81C787F382
                                                                                                                                                                                                                                                      SHA1:C6E877ABA3FB3D2F21D86BE300E753E23BB0B74E
                                                                                                                                                                                                                                                      SHA-256:825174429CED6B3DAB18115DBC6C9DA07BF5248C86EC1BD5C0DCAECA93B4C22D
                                                                                                                                                                                                                                                      SHA-512:45594FA3C5D7C4F26325927BB8D51B0B88E162E3F5E7B7F39A5D72437606383E9FDC8F83A77F814E45AFF254914514AE52C1D840A6C7B98767F362ED3F4FC5BD
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....................E....q............q......q......q......<.............<......<......<......<.)....<......Rich....................PE..d......_.........." .....(..........D-.......................................0............`.............................................t...4...........@........%........... ..(....d..T................... f..(....d..0............@..0............................text....&.......(.................. ..`.rdata...v...@...x...,..............@..@.data...(...........................@....pdata...%.......&..................@..@.qtmetad............................@..P.rsrc...@...........................@..@.reloc..(.... ......................@..B........................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\plugins\imageformats\qwbmp.dll

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):30192
                                                                                                                                                                                                                                                      Entropy (8bit):5.938644231596902
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:768:EfEM3S46JE2X/xBZ76pC5J6GdDGZUf2h4:63S3JE2PHZ76pC5J6GEUfn
                                                                                                                                                                                                                                                      MD5:68919381E3C64E956D05863339F5C68C
                                                                                                                                                                                                                                                      SHA1:CE0A2AD1F1A46B61CB298CEC5AA0B25FF2C12992
                                                                                                                                                                                                                                                      SHA-256:0F05969FB926A62A338782B32446EA3E28E4BFBFFC0DBD25ED303FAB3404ABAC
                                                                                                                                                                                                                                                      SHA-512:6222A3818157F6BCD793291A6C0380EF8C6B93ECEA2E0C9A767D9D9163461B541AFAF8C6B21C5A020F01C95C6EE9B2B74B358BA18DA120F520E87E24B20836AA
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........]...<.I.<.I.<.I.D%I.<.I.S.H.<.I.W.H.<.I.S.H.<.I.S.H.<.I.S.H.<.IYL.H.<.I.<.I.<.IYL.H.<.IYL.H.<.IYLII.<.IYL.H.<.IRich.<.I........PE..d......_.........." ..... ...8.......'....................................................`......................................... D..t....D..........@....p..T....Z...............6..T...................p8..(...@7..0............0..p............................text............ .................. ..`.rdata..d&...0...(...$..............@..@.data........`.......L..............@....pdata..T....p.......N..............@..@.qtmetad~............R..............@..P.rsrc...@............T..............@..@.reloc...............X..............@..B........................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\plugins\imageformats\qwebp.dll

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):510448
                                                                                                                                                                                                                                                      Entropy (8bit):6.605517748735854
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:12288:bPTjgdqdsvh+LrLrLrL5/y4DVHAsqx3hXS+oPZQqRaYG:jT5sMLrLrLrL5q4dAsaOFo
                                                                                                                                                                                                                                                      MD5:308E4565C3C5646F9ABD77885B07358E
                                                                                                                                                                                                                                                      SHA1:71CB8047A9EF0CDB3EE27428726CACD063BB95B7
                                                                                                                                                                                                                                                      SHA-256:6E37ACD0D357871F92B7FDE7206C904C734CAA02F94544DF646957DF8C4987AF
                                                                                                                                                                                                                                                      SHA-512:FFAEECFAE097D5E9D1186522BD8D29C95CE48B87583624EB6D0D52BD19E36DB2860A557E19F0A05847458605A9A540C2A9899D53D36A6B7FD5BF0AD86AF88124
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.................a....s........s......s......s....>.........>......>.....>....>......>....Rich...................PE..d......_.........." .....B..........tH.......................................0......`q....`..........................................W..t....W..........@.......0H........... ......h...T.......................(.......0............`...............................text...[@.......B.................. ..`.rdata..J....`.......F..............@..@.data....'...........X..............@....pdata..0H.......J...\..............@..@.qtmetadv...........................@..P.rsrc...@...........................@..@.reloc....... ......................@..B........................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\plugins\platforms\qminimal.dll

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):844784
                                                                                                                                                                                                                                                      Entropy (8bit):6.625808732261156
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:12288:y6MhioHKQ1ra8HT+bkMY8zKI4kwU7dFOTTYfEWmTxbwTlWc:BMhioHKQp+bkjAjwGdFSZtbwBd
                                                                                                                                                                                                                                                      MD5:2F6D88F8EC3047DEAF174002228219AB
                                                                                                                                                                                                                                                      SHA1:EB7242BB0FE74EA78A17D39C76310A7CDD1603A8
                                                                                                                                                                                                                                                      SHA-256:05D1E7364DD2A672DF3CA44DD6FD85BED3D3DC239DCFE29BFB464F10B4DAA628
                                                                                                                                                                                                                                                      SHA-512:0A895BA11C81AF14B5BD1A04A450D6DCCA531063307C9EF076E9C47BD15F4438837C5D425CAEE2150F3259691F971D6EE61154748D06D29E4E77DA3110053B54
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........#\..B2..B2..B2..:...B2..-3..B2.F....B2..-7..B2..-6..B2..-1..B2..)6..B2.^23..B2..)3..B2..B3.@2.^26..B2.^27..B2.^22..B2.^2...B2.^20..B2.Rich.B2.........PE..d...N._.........." ......................................................... ............`......................................... ...x.......@.......H....`..H.......................T.......................(.......0...............(............................text...;........................... ..`.rdata...C.......D..................@..@.data...H....@......."..............@....pdata..H....`.......0..............@..@.qtmetad............................@..P.rsrc...H...........................@..@.reloc..............................@..B................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\plugins\platforms\qoffscreen.dll

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):754672
                                                                                                                                                                                                                                                      Entropy (8bit):6.6323155845799695
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:12288:/HpBmyVIRZ3Tck83vEgex5aebusGMIlhLfEWmpCJkl:/HpB63TckUcLaHMITAZmW
                                                                                                                                                                                                                                                      MD5:6407499918557594916C6AB1FFEF1E99
                                                                                                                                                                                                                                                      SHA1:5A57C6B3FFD51FC5688D5A28436AD2C2E70D3976
                                                                                                                                                                                                                                                      SHA-256:54097626FAAE718A4BC8E436C85B4DED8F8FB7051B2B9563A29AEE4ED5C32B7B
                                                                                                                                                                                                                                                      SHA-512:8E8ABB563A508E7E75241B9720A0E7AE9C1A59DD23788C74E4ED32A028721F56546792D6CCA326F3D6AA0A62FDEDC63BF41B8B74187215CD3B26439F40233F4D
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m..T..KT..KT..K]t7K@..K.c.JV..K@g.JV..K.cKU..K.c.JA..K.c.J\..K.c.JP..K.|.JQ..KT..K...K.|.Js..K.|.JS..K.|.JU..K.|[KU..K.|.JU..KRichT..K........PE..d...R._.........." ................L.....................................................`.............................................x...8...........H....... s...h..........p.......T................... ...(.......0...............@............................text............................... ..`.rdata..............................@..@.data...............................@....pdata.. s.......t..................@..@.qtmetad.............T..............@..P.rsrc...H............V..............@..@.reloc..p............Z..............@..B........................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\plugins\platforms\qwebgl.dll

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):482288
                                                                                                                                                                                                                                                      Entropy (8bit):6.152380961313931
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:6144:WO/vyK+DtyaHlIMDhg5WEOvAwKB2VaaHeqRw/yVfYu4UnCA6DEjeYchcD+1Zy2:bKtHOWg5OvAwK0NYu4AShcD+1U2
                                                                                                                                                                                                                                                      MD5:1EDCB08C16D30516483A4CBB7D81E062
                                                                                                                                                                                                                                                      SHA1:4760915F1B90194760100304B8469A3B2E97E2BC
                                                                                                                                                                                                                                                      SHA-256:9C3B2FA2383EEED92BB5810BDCF893AE30FA654A30B453AB2E49A95E1CCF1631
                                                                                                                                                                                                                                                      SHA-512:0A923495210B2DC6EB1ACEDAF76D57B07D72D56108FD718BD0368D2C2E78AE7AC848B90D90C8393320A3D800A38E87796965AFD84DA8C1DF6C6B244D533F0F39
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........gM..#...#...#..~....#.ei&...#.ei'...#.ei ...#..m'...#.ei"...#.(v"...#..m"...#..."...#.(v&...#.(v#...#.(v...#.(v!...#.Rich..#.................PE..d......_.........." .....R...........;....................................................`..........................................m..t...Dn..T.......@....@...=...@..............0...T.......................(.......0............p..(............................text...{Q.......R.................. ..`.rdata..:....p.......V..............@..@.data...H....0......................@....pdata...=...@...>..................@..@.qtmetadz............2..............@..P.rsrc...@............4..............@..@.reloc...............8..............@..B........................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\plugins\platforms\qwindows.dll

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):1477104
                                                                                                                                                                                                                                                      Entropy (8bit):6.575113537540671
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:24576:4mCSPJrAbXEEuV9Hw2SoYFo3HdxjEgqJkLdLu5qpmZuhg/A2b:nPlIEEuV9Hw2SFFWHdWZsdmqja/A2b
                                                                                                                                                                                                                                                      MD5:4931FCD0E86C4D4F83128DC74E01EAAD
                                                                                                                                                                                                                                                      SHA1:AC1D0242D36896D4DDA53B95812F11692E87D8DF
                                                                                                                                                                                                                                                      SHA-256:3333BA244C97264E3BD19DB5953EFA80A6E47AACED9D337AC3287EC718162B85
                                                                                                                                                                                                                                                      SHA-512:0396BCCDA43856950AFE4E7B16E0F95D4D48B87473DC90CF029E6DDFD0777E1192C307CFE424EAE6FB61C1B479F0BA1EF1E4269A69C843311A37252CF817D84D
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                      Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......i...-...-...-...$.%.9.....q.,......8......%......)......+...9......9..,......)..........9..8...-..........d......,.....I.,......,...Rich-...........PE..d....._.........." .....,...h......4+..............................................n.....`.............................................x...(...........H............n..........X....r..T...................Pt..(... s..0............@...5...........................text..._+.......,.................. ..`.rdata.......@.......0..............@..@.data....m...@...D...(..............@....pdata...............l..............@..@.qtmetad.............J..............@..P.rsrc...H............L..............@..@.reloc..X............P..............@..B........................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\plugins\platformthemes\qxdgdesktopportal.dll

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):68592
                                                                                                                                                                                                                                                      Entropy (8bit):6.125954940500008
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:1536:Nt4B1RLj3S6TtH2sweUH+Hz6/4+D6VFsfvUfO:AB1RHFdoeUs6/4O6VFSZ
                                                                                                                                                                                                                                                      MD5:F66F6E9EDA956F72E3BB113407035E61
                                                                                                                                                                                                                                                      SHA1:97328524DA8E82F5F92878F1C0421B38ECEC1E6C
                                                                                                                                                                                                                                                      SHA-256:E23FBC1BEC6CEEDFA9FD305606A460D9CAC5D43A66D19C0DE36E27632FDDD952
                                                                                                                                                                                                                                                      SHA-512:7FF76E83C8D82016AB6BD349F10405F30DEEBE97E8347C6762EB71A40009F9A2978A0D8D0C054CF7A3D2D377563F6A21B97DDEFD50A9AC932D43CC124D7C4918
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o...o...o...f...k......m...{..m......~......h......m......h...o..........k......n.....~.n......n...Richo...........................PE..d...V._.........." .....z...t......T........................................@.......b....`......................................... ................ ..X....................0..4.......T.......................(...p...0...............x............................text....y.......z.................. ..`.rdata...Z.......\...~..............@..@.data...............................@....pdata..............................@..@.qtmetad............................@..P.rsrc...X.... ......................@..@.reloc..4....0......................@..B........................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\plugins\styles\qwindowsvistastyle.dll

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):144368
                                                                                                                                                                                                                                                      Entropy (8bit):6.294675868932723
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:3072:rrjwZ43rCOtrBk7wcR0l7wBlaL6BtIEt51T0Nhkqg8FoQY:7hZu9R0l7wFBtIEt51T0Nuqg8JY
                                                                                                                                                                                                                                                      MD5:53A85F51054B7D58D8AD7C36975ACB96
                                                                                                                                                                                                                                                      SHA1:893A757CA01472A96FB913D436AA9F8CFB2A297F
                                                                                                                                                                                                                                                      SHA-256:D9B21182952682FE7BA63AF1DF24E23ACE592C35B3F31ECEEF9F0EABEB5881B9
                                                                                                                                                                                                                                                      SHA-512:35957964213B41F1F21B860B03458404FBF11DAF03D102FBEA8C2B2F249050CEFBB348EDC3F22D8ECC3CB8ABFDC44215C2DC9DA029B4F93A7F40197BD0C16960
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......R._...1]..1]..1]..]..1]..0\..1]..5\..1]..2\..1]..4\..1]..0\..1]..0\..1]..0]..1]..4\..1]..1\..1]...]..1]..3\..1]Rich..1]........................PE..d...`._.........." .....\...........`.......................................`......wJ....`................................................. ........@..X.... ...............P.........T...................`...(...0...0............p...............................text....Z.......\.................. ..`.rdata......p.......`..............@..@.data...............................@....pdata....... ......................@..@.qtmetadm....0......................@..P.rsrc...X....@......................@..@.reloc.......P......................@..B........................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\translations\qt_ar.qm

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):130
                                                                                                                                                                                                                                                      Entropy (8bit):4.024232093209084
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:3:j2wZC4C/2/vlAlHekW3/S1MUe3/CLlI+rwtbWlMrNtYs8ar/u:Cwm+/PtUePCRIRt6Ygs8y/u
                                                                                                                                                                                                                                                      MD5:8FF05B56C0995F90A80B7064AA6E915C
                                                                                                                                                                                                                                                      SHA1:D5AEB09AE557CEEFB758972EC4AC624CDDC9E6A7
                                                                                                                                                                                                                                                      SHA-256:A8A1B0D6F958E7366D1C856BE61000106D3E7FC993FB931675369892B9002D0B
                                                                                                                                                                                                                                                      SHA-512:5374E0F1D3F5A6A456B00732DE8005787B17ECEF9C8A2B2C1228966A6A8DE211700334D8FD789DAD269F52D0AEED3F5160010CA60909861E270C253B3EA881A4
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:<.d....!..`.......ar....R.....q.t.b.a.s.e._.a.r.....q.t.s.c.r.i.p.t._.a.r.....q.t.m.u.l.t.i.m.e.d.i.a._.a.r..............$...*.

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\translations\qt_bg.qm

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):153
                                                                                                                                                                                                                                                      Entropy (8bit):3.6813848812976975
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:3:j2wZC4C/6lLlAlHekVYtzlY1MUdI7lULlI+rwtbWlMoIFl8IPldkO4t/z:CwDC+7tJjUWhURIRt68f8oiP1z
                                                                                                                                                                                                                                                      MD5:466EED6C184D2055488D4C5EA9AE5F20
                                                                                                                                                                                                                                                      SHA1:8599AB9B731BFC84F6EEC7A0129F396FB8FEC4EA
                                                                                                                                                                                                                                                      SHA-256:9E1CE4D91852352043D9191F1A992838F919CBA7E2F2D9BB1161E494E8BF5F5E
                                                                                                                                                                                                                                                      SHA-512:D2462951EC7DCE3D0851AE9C4ED644FFE0D2A5BDD15B4AE1A4295C187B4295BC854D6A5038DAC0564D165463419D615EB6CE7A9760CEFAD71AB673FB2109C349
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:<.d....!..`.......bg....v.....q.t.b.a.s.e._.b.g.....q.t.s.c.r.i.p.t._.b.g.....q.t.m.u.l.t.i.m.e.d.i.a._.b.g... .q.t.x.m.l.p.a.t.t.e.r.n.s._.b.g.......

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\translations\qt_ca.qm

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):153
                                                                                                                                                                                                                                                      Entropy (8bit):3.631479835393124
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:3:j2wZC4C/NVl/lAlHekUOplY1MUce/hlAlI+rwtbWlMpOflUlIPldkOHlz:CwO4+94jUcerAIRt6a6Uloi8
                                                                                                                                                                                                                                                      MD5:6FBA66FE449866B478A2EBA66A724A02
                                                                                                                                                                                                                                                      SHA1:EBEF6ED8460218CE8DF735659A8CBCD693600AC6
                                                                                                                                                                                                                                                      SHA-256:171C7424B24D8502AB53CB3784FF34D8FCFAE26557CF8AF4DFDDEC6485ACC2FE
                                                                                                                                                                                                                                                      SHA-512:2D2438738C6D10D8A53B46DE5A94BBF993818D080F344D9F1B94FC83D60335D9A5E8EFCC297D593FFF1D427972F9F9502FC31C332CAEA579FC7A88487390457E
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:<.d....!..`.......ca....v.....q.t.b.a.s.e._.c.a.....q.t.s.c.r.i.p.t._.c.a.....q.t.m.u.l.t.i.m.e.d.i.a._.c.a... .q.t.x.m.l.p.a.t.t.e.r.n.s._.c.a.......

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\translations\qt_cs.qm

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):157
                                                                                                                                                                                                                                                      Entropy (8bit):3.7483537099309427
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:3:j2wZC4C/fVFlAlHekUsplY1MUcM/hlULlI+rwtbWlMpsfl8IPldkO1lPchn:CwY4+9ujUcMrURIRt6aE8oinh
                                                                                                                                                                                                                                                      MD5:D033053C03C3ECFA2AA926E0E674F67F
                                                                                                                                                                                                                                                      SHA1:B4E95F8278121E2549F8BB6B5DAF1496F1738A7D
                                                                                                                                                                                                                                                      SHA-256:3C0CBFD19490D67D1B3B9E944C3A4D9A9E7F87D7AE35E88D5D5A0077349B5B21
                                                                                                                                                                                                                                                      SHA-512:2C7E9E9DBE0B25FBA94A52FE4BCCB1D9FED2A7BD2877DB91F82546C3BC8606280949594227BA0FC1C74C31010E1F573B3A82852BE746EAA4F397140485789136
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:<.d....!..`.......cs....v.....q.t.b.a.s.e._.c.s.....q.t.s.c.r.i.p.t._.c.s.....q.t.m.u.l.t.i.m.e.d.i.a._.c.s... .q.t.x.m.l.p.a.t.t.e.r.n.s._.c.s...........

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\translations\qt_da.qm

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):153
                                                                                                                                                                                                                                                      Entropy (8bit):3.6174817344122334
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:3:j2wZC4C/4Jlr/lAlHekT6hY1MUb6JAlI+rwtbWlMuel3UlIPldkOQtt:Cw7rC+3jUkAIRt6EVUloi9
                                                                                                                                                                                                                                                      MD5:E6A683F4A0883B5B0C7D30B847EF208C
                                                                                                                                                                                                                                                      SHA1:FF2440DBBFE04AD86C6F285426AAFD49A895B128
                                                                                                                                                                                                                                                      SHA-256:B5036161CE808C728E5FDA985F792DB565831FD01CF00B282547790C037353A2
                                                                                                                                                                                                                                                      SHA-512:D73B794A71DFD3A3C06BF43ED109F635B4960F9A3904FB728873AB5251BDF6A791DDFDEBA884A2703A35461E18BA902804095AC4B92A2C9361526469B6D35FFA
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:<.d....!..`.......da....v.....q.t.b.a.s.e._.d.a.....q.t.s.c.r.i.p.t._.d.a.....q.t.m.u.l.t.i.m.e.d.i.a._.d.a... .q.t.x.m.l.p.a.t.t.e.r.n.s._.d.a.......

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\translations\qt_de.qm

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):153
                                                                                                                                                                                                                                                      Entropy (8bit):3.6174817344122334
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:3:j2wZC4C/8rJFlAlHekTul01MUbul4LlI+rwtbWlMuallyIPldkOknt:Cw/rJ4+XU5RIRt6Aaoi7t
                                                                                                                                                                                                                                                      MD5:06168E1261BF72F49F94927723B2E1EB
                                                                                                                                                                                                                                                      SHA1:DEAF1B53C3FEE6CB28840418D0060AFA4D59D3FC
                                                                                                                                                                                                                                                      SHA-256:5805B8FF3747849794E2D70661D737C69C15F1AE763C38E17084B1E5A81E9153
                                                                                                                                                                                                                                                      SHA-512:AA3915C029C74DC270514C7F50E8BEC06C825F278E0DE0477AD8ED3187700BBD7711382A6E47C3AC76AC756CEFF9FA8CDD4E9B9DAC817475BC122F78B02C7D7D
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:<.d....!..`.......de....v.....q.t.b.a.s.e._.d.e.....q.t.s.c.r.i.p.t._.d.e.....q.t.m.u.l.t.i.m.e.d.i.a._.d.e... .q.t.x.m.l.p.a.t.t.e.r.n.s._.d.e.......

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\translations\qt_en.qm

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):16
                                                                                                                                                                                                                                                      Entropy (8bit):4.0
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:3:j2wZC4n:CwZ
                                                                                                                                                                                                                                                      MD5:BCEBCF42735C6849BDECBB77451021DD
                                                                                                                                                                                                                                                      SHA1:4884FD9AF6890647B7AF1AEFA57F38CCA49AD899
                                                                                                                                                                                                                                                      SHA-256:9959B510B15D18937848AD13007E30459D2E993C67E564BADBFC18F935695C85
                                                                                                                                                                                                                                                      SHA-512:F951B511FFB1A6B94B1BCAE9DF26B41B2FF829560583D7C83E70279D1B5304BDE299B3679D863CAD6BB79D0BEDA524FC195B7F054ECF11D2090037526B451B78
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:<.d....!..`...

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\translations\qt_es.qm

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):153
                                                                                                                                                                                                                                                      Entropy (8bit):3.6070658648473097
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:3:j2wZC4C/7lJFlAlHekSMthULlI+rwtbWlMvEJY1MUaEf8IPldkOzvt:CwElJ4+7MrURIRt6cujUaE8oi0F
                                                                                                                                                                                                                                                      MD5:EE47DFADBA4414FDC051C5CFBE71DDC1
                                                                                                                                                                                                                                                      SHA1:DE650E96A9C130D35F8A498202773EF7FC875D27
                                                                                                                                                                                                                                                      SHA-256:E25E43F046F61022FFE871A2F73C6A12EDFC5C3EFD958C0E019A721860A053B0
                                                                                                                                                                                                                                                      SHA-512:8C1D8901D2F66CCBF947B831858E08B703517470B2B813B241E00162A275AC9103FF5B9251AD39BD53551E0A4FB45EE74187B218A1EF7C6CF6C5FA9F9219AE04
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:<.d....!..`.......es....v.....q.t.b.a.s.e._.e.s.....q.t.m.u.l.t.i.m.e.d.i.a._.e.s.....q.t.s.c.r.i.p.t._.e.s... .q.t.x.m.l.p.a.t.t.e.r.n.s._.e.s.......

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\translations\qt_fa.qm

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):293121
                                                                                                                                                                                                                                                      Entropy (8bit):5.272179385890926
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:3072:gEo2cQbzaVmvGQYkHkMRKkNeGr+0BhaRsLAChY21rpnLqL9ytnvC58gypn4l4qF:gEZbza0HjeGrxBhaCLFC
                                                                                                                                                                                                                                                      MD5:F9C3624197ACB30A9E6CC799BB65BED6
                                                                                                                                                                                                                                                      SHA1:D715EAE24387DE15588F68C92991A93FAFB5EEAB
                                                                                                                                                                                                                                                      SHA-256:B292AFB0763B8C7C30A5AF7372BFC12D8A0D00BF3DD4A000715D9F576D9C1A39
                                                                                                                                                                                                                                                      SHA-512:199C107AE7EAFCF2A5EEC149CAFEE7ED09B938E204B56AD3AAC9568D27166F61EC8E2225A11AF26F7E1F035FB5CAD98621A01E8A9942D18C273F43B90201162A
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:<.d....!..`.......faB..I....*...u...+...............@.......A...J...B.......C...X...D.......E.......F...%...G.......H...0...I.......P...v...Q.......R.......S.......T..."...U.......V...h...W.......X...s...Y.......]..e....t...................-.......W.......|.......i...;..Eu...;..Z....;...]...;..c....;.......;..0]...M..f....O.......O..2.......#....}..f=...m..fg.........(5......+;..1a..+;...V..+;...!..+O..17..+O...(..1.......E@......F....u..H4......HY...Y..H....S..I....5..I@.....IA......IC......J...1...J.......J.......J...|...K...6...LD......L.......PS......R....Z..T.......Zr.. ...[`...O..[`......\...%@..\...2..._...&l.._...38..1........E..........2u..........1.......1...........@......4G...........................$...L...$..xY...[.......,...u...y...y...y..z.......F.......<.......g.......5W...........9...........f...E...U...E../....E..................0-...%..6....%.........................3......f..........5...?...0..EK...0......0..L ...0..c....0.......0...Z...5...........Y.. D

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\translations\qt_fi.qm

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):117
                                                                                                                                                                                                                                                      Entropy (8bit):3.739162292019161
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:3:j2wZC4C/4HlAlHekRgOp1MUZWJKlI+rwtbWlMsIkk:Cwxe++IUocIRt6Qkk
                                                                                                                                                                                                                                                      MD5:72882942B07B8AAC98034016E752B1A0
                                                                                                                                                                                                                                                      SHA1:BF23B4C136B863B10E770019A2DF62FC988859DF
                                                                                                                                                                                                                                                      SHA-256:048CA42DCE4FAF5FC21D843576E3C6FD963146ECC78554E7E5F34D07F64FB213
                                                                                                                                                                                                                                                      SHA-512:403E7F4E9A0E44F2118804F0781A18EB1852797825498751E3AFA02D9558D90293ABDB570786CED80F7EFF800BEF6D9444A72E6A640D331DA46B2A0EA43C8E96
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:<.d....!..`.......fi....R.....q.t.b.a.s.e._.f.i.....q.t.s.c.r.i.p.t._.f.i.....q.t.m.u.l.t.i.m.e.d.i.a._.f.i.......

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\translations\qt_fr.qm

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):153
                                                                                                                                                                                                                                                      Entropy (8bit):3.680458675741643
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:3:j2wZC4C/FjlAlHekRL21MUZNJOLlI+rwtbWlMs9KIPldkORT:Cw3+SU0RIRt6koio
                                                                                                                                                                                                                                                      MD5:3C45C665CFE036A7474CB4DCBB13CF40
                                                                                                                                                                                                                                                      SHA1:62312DFF3C4CD38BAE8456C981601D0D89600F63
                                                                                                                                                                                                                                                      SHA-256:8624033D849E670B12C9532337FCBF260F20848E044FEE7787CFE2AC92BE28DB
                                                                                                                                                                                                                                                      SHA-512:21659AA452BC2493D915F0BE94F90CDD57759B1F1306AAA2836058D41E80DED24742EBD74E19420021514A6AB4150CA0B447574E96B9D3BF0BC5A8C78DAAF7AC
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:<.d....!..`.......fr....v.....q.t.b.a.s.e._.f.r.....q.t.s.c.r.i.p.t._.f.r.....q.t.m.u.l.t.i.m.e.d.i.a._.f.r... .q.t.x.m.l.p.a.t.t.e.r.n.s._.f.r.......

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\translations\qt_gd.qm

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):70
                                                                                                                                                                                                                                                      Entropy (8bit):4.463523104731333
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:3:j2wZC4C/EXlAlHekQrEuknbJB:CwjO+5JY
                                                                                                                                                                                                                                                      MD5:A8D55457C0413893F746D40B637F9C93
                                                                                                                                                                                                                                                      SHA1:25123615482947772176E055E4A74043B2FBCAA0
                                                                                                                                                                                                                                                      SHA-256:49DF855A004A17950338AF3146466F6DF4D5852410BD0B58EA80E0D0203A9D24
                                                                                                                                                                                                                                                      SHA-512:99718B948D94B292BDEDF6B247A5856BC7AC78408FCC41C980F264C2C8565125786F0289F5F993DCF11B8CDA3AFB2A1D8634B1D0BC9B34992F538F8E4086EC00
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:<.d....!..`.......gd..........q.t.b.a.s.e._.g.d....................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\translations\qt_gl.qm

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):323590
                                                                                                                                                                                                                                                      Entropy (8bit):4.568068046062524
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:3072:OYSG8zxWSDjq73Pf6FT1f4uh50QGrRfFD54YyUY0Ou4/tnra3Z0uYhB5YHfHRRn2:O39WSD3TMQGrxFD5EUVQ
                                                                                                                                                                                                                                                      MD5:0661FFABFBC50187F3BA38876B721946
                                                                                                                                                                                                                                                      SHA1:EB5E7205355CFC6BCB4DF27E224079842C97B296
                                                                                                                                                                                                                                                      SHA-256:204A01AC7DEB6B5BAE193AFECBD1E50D18C73BF7D94BADEB2BBFDF6123C4ED93
                                                                                                                                                                                                                                                      SHA-512:65AB66CC54D65E7678FA731A5C5F2CC9D6FC217B91AD47D538440811E09A23E49CD95CE62A79E3E8C275E250AC1A0B54BD289F6DD067573876DA7AFF54381D02
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:<.d....!..`.......gl_ESB..I....*.......+..&............@.......A...z...B.......C...p...D.......E......F...!...G......H.......I......P...@...Q.......R......S...5...T......U...+...V.......W...a...X.......Y...N...]..o....t..,................F.......p..............4....;..LI...;..bD...;.......;.......;.......;..cJ...M..o1...O..G....O..e.......U....}..oY...m..o........D..(5...X..+;..6/..+;...~..+;......+O..6...+O...N..1......E@...?..F.......H4..'...HY......H...3`..I......I@......IA......IC..0...J...P...J...1...J...0...J.......K...:...LD..2...L...3...PS..:A..R... d..T.......Zr..Rd..[`......[`.....\...WK..\...RR.._...X..._...f...1........E...{......7M..........1.......1....q......O.......9...............*.......)....$... ...$.......[..,=...,..-....y..0X...y...~......Mx......]0.......H......:A......0....9...............E...o...E..b....E.........1.......c....%..;....%...;......3.......^......S................5..4Z...0..L....0.......0..n....0.......0..7....0.......5..9D......!g.

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\translations\qt_he.qm

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):83
                                                                                                                                                                                                                                                      Entropy (8bit):3.880645689209568
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:3:j2wZC4C/YJ/dQlHekfaB21MUXmlvt:CwT0+D/UUt
                                                                                                                                                                                                                                                      MD5:DD5C2C6B148F2DB3E666B859776AE129
                                                                                                                                                                                                                                                      SHA1:8368F32039CC0776A1B95C9DED5FE6C9EA0D93FD
                                                                                                                                                                                                                                                      SHA-256:C113D14E218D5402B616DABEA27969C6F83852676468C5EF051DDDEFB3EE0235
                                                                                                                                                                                                                                                      SHA-512:2EAE33C8707407E083F6B8B05EA2C5B987646DF1553888C16D6508C5A33B2F758DDED73323622CD50324C96F51D61B7CE822F393551A30B211ABD3CC1367249F
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:<.d....!..`.......he....0.....q.t.b.a.s.e._.h.e.....q.t.s.c.r.i.p.t._.h.e.......

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\translations\qt_help_ar.qm

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):8743
                                                                                                                                                                                                                                                      Entropy (8bit):5.189558605179696
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:192:YUM7gBwnG4Vxj4nyn9aAMOJckrL6esm/0sQ5HeK1nvEB:YBkKnZxkyn9aAMWPsm/0sQsGvEB
                                                                                                                                                                                                                                                      MD5:CCD39A7C8139AD041E31B3E5D40968B4
                                                                                                                                                                                                                                                      SHA1:5751BE96817BB6AE7C9DA9F1FBA7F42F31CFCC5D
                                                                                                                                                                                                                                                      SHA-256:222088C9752D1CC3BAB985EF2DC77E5AE78578DCE18A61EC15B39F02E588163D
                                                                                                                                                                                                                                                      SHA-512:9844C0EC65EE1C76DBA021EAC6D476A85E6C8F5BBAF4150C1EA80C0A95BEDE67B5E8F981360EF8599FCECDFCBCB83BC0B8AC44DDEFDCD85F914318030E346967
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:<.d....!..`.......arB.....(.....d.0T....*.5w......Uj....!.`.....M.a[............n..t..............39....&................B<s...V..M^...e......4.O5^...r..)^......o>...........?...t.....D ......k.N.....k.N...C...n...T...I...R..........2>.................|..G.......w....T.......l..........,................^............$a......6.>...........x..K......W.b....._Xn......GN...m..~......!.....J.K.H.............pN.............P.~.....o.....W..(.......~......s.>......%c.....o.....R.z.q..........................n.h................e.....i..........:.J.1. .E.3.E.Q.I..........Untitled.....QHelp.....8.*.9.0.Q.1. .F.3... .E.D.A.Q. .'.D.*.Q.,.E.J.9.).:. .%.1..........Cannot copy collection file: %1.....QHelpCollectionHandler.......*.9.0.Q.1. .%.F.4.'.!. .'.D./.Q.D.J.D.:. .%.1..........Cannot create directory: %1.....QHelpCollectionHandler.....>.*.9.0.Q.1. .%.F.4.'.!. .,./.'.H.D. .A.J. .'.D.E.D.A.Q. .%.1........... Cannot create tables in file %1......QHelpCollectionHandler.....L.*.9.0.Q.1. .*.

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\translations\qt_help_bg.qm

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):10599
                                                                                                                                                                                                                                                      Entropy (8bit):5.192287379770591
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:192:jhYkcd7CYBdmfIOeX3byuJRoZXlBYnEpUYR+BJqO5X9pA2NNrxC0zwRK2nMY762A:a71DQIrLuVCnEtR+DquhN5xC0zwKPYHA
                                                                                                                                                                                                                                                      MD5:5538049DA3A1D1D724AB6E11D2E2EDBE
                                                                                                                                                                                                                                                      SHA1:7256BE390B88A053C0252488C443BE42F6F2D92A
                                                                                                                                                                                                                                                      SHA-256:CBCDD1E0BBAE332D80DDB0A286056F17C824FA28D353D7FDF12FC97D9F6FE054
                                                                                                                                                                                                                                                      SHA-512:DD98CAF3A016968EEDC9106C1839DDECC2D109E9E354708BD74B35E766C6A098C1680C0B867EAD9FCE2E2A6D683BE673B8E5DF1A1B2F1AAFDB31910FF833370F
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:<.d....!..`.......bgB...(.(.......0T......5w... S.Uj......`.......a[....(..........t..............39..........&..........B<s...4..M^..........q...J..%..O5^...O..)^...I..o>...I...J..%.......#....t...A.8dz..$..D ....Z.k.N...<.k.N.......n.......I..............2>...p................G..."...w....................7..,................^............$a....<.6.>..........#...K...........$1.W.b....._Xn......GN...*..~....-..TH.."..!.....5.K.H..#R.........pN..."......&..P.~...@.o.....v..(.........."8..~......s.>.....o.... ..z.q..........................O.h....!t..........e....mi..'.....|.(...@.8.G.8.=.0.B.0. .<.>.6.5. .4.0. .5.,. .G.5. .4.>.:.C.<.5.=.B.0.F.8.O.B.0. .2.A.5. .>.I.5. .A.5. .8.=.4.5.:.A.8.@.0...).........M(The reason for this might be that the documentation is still being indexed.).....QCLuceneResultWidget.........0.1.5.;.5.6.:.0.:..........Note:.....QCLuceneResultWidget.....,. .5.7.C.;.B.0.B.8. .>.B. .B.J.@.A.5.=.5.B.>..........Search Results.....QCLuceneResultWidget....... .

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\translations\qt_help_ca.qm

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):7444
                                                                                                                                                                                                                                                      Entropy (8bit):4.580794980254807
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:192:G8oS34B7n303D37Bn3Jso37cfp3Mg3H373R58noct36R9RFu:GQU7ETrxZvqTXLSoct36Pzu
                                                                                                                                                                                                                                                      MD5:66722ED97BCBFD3DAE3C8264413859AB
                                                                                                                                                                                                                                                      SHA1:400A93B213FCF9BBC9785881EA82ADB9F444CD6C
                                                                                                                                                                                                                                                      SHA-256:ECD4283A660F2CF72849B323810D7EADD063120B6F561E05AA1243A5B280946A
                                                                                                                                                                                                                                                      SHA-512:B898BAC9652D7532384ED5CC53FA62DB55D516421D13F815A3E6D5E80AD4C69555F1A7E6C51F8B0A234614824EEE01D6731458F90D40A585990F84A58B9ABE44
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:<.d....!..`.......caB............%.......0T......K:^.....Uj......`.....P..YJ...V.E.4...*...........>...7........B<s.....B\>...6........+.s.....zq.......9.......vR......@.......@.......:....;.8Z....!.g.N......F................t.....D ....z.k.N.......I......^......`#.......2.......G........N...7......N......{..................K...............GN......NO...5.........K.H...@.........pN......V............q..................>...N.........~.....5..%c...:.z.q....i...4....".A.f.e.g.e.i.x. .u.n. .f.i.l.t.r.e..........Add Filter.....FilterNameDialogClass.......N.o.m. .d.e.l. .f.i.l.t.r.e.:..........Filter Name:.....FilterNameDialogClass.......S.e.n.s.e. .t...t.o.l..........Untitled.....QHelp.....`.N.o. .s.'.h.a. .p.o.g.u.t. .c.o.p.i.a.r. .e.l. .f.i.t.x.e.r. .d.e. .c.o.l...l.e.c.c.i...:. .%.1..........Cannot copy collection file: %1.....QHelpCollectionHandler.....H.N.o. .s.'.h.a. .p.o.g.u.t. .c.r.e.a.r. .e.l. .d.i.r.e.c.t.o.r.i.:. .%.1..........Cannot create directory: %1.....QHelpCollect

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\translations\qt_help_cs.qm

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):15297
                                                                                                                                                                                                                                                      Entropy (8bit):4.708378368926237
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:384:hmv1gdEYEiNrVhTBvAn1ca1f5lwHoJr0vwuxqsP/5jxA:o1gdEvgbloCof9ixqspW
                                                                                                                                                                                                                                                      MD5:ED228F0F60AE9AEC28AB9171D5AE9590
                                                                                                                                                                                                                                                      SHA1:7F061CF0C699D125A5531E3480C21964452F45EA
                                                                                                                                                                                                                                                      SHA-256:4AC56FC63E400943BAB13F1D4C418502138908E1D488C24AEE6131D3D17552AA
                                                                                                                                                                                                                                                      SHA-512:794CC671C08BFC50980820A6389B9D0D3514619AD0A8F18EFD5554CBBF2482192DF00B9D3B05FEE45F42276E63E2375FB28E193930D426245035B4B0E3E14ED8
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:<.d....!..`.......cs_CZB...H.(.......(.......0T......0T......5w...0..Uj......`.......a[......a[....$.......p..........t.......t...........!..1"....T.39....T.39.......s...0......(......7/.................B<s...L..MQ......M^../q..........J..6@.0....*B.O5Q..'..O5^..(A..)Q...X..)^......o>..........+....J..6.......4....t.....8dz..5..D ....R.D ......k.A.....k.A.....k.N.....k.N.......n.."....I..........................2...21......2>..........d.............T..G...4...w...!N......&O......&....!..".......#E..,...,.......)....Q..$/...^..$................$a......6.>.. t......5...K.......K....)......5E.W.b..-.._Xa..%a._Xn..%...GA......GN...?......,9..~.......TH..3..!....*..K.H..4h.........pA...J..pN..........7..P.~.. ..o.....0..(....*..(..........3V..~....T.s.1.....s.>..._.o....0..o....1p.z.q..........'9.....#........^.........h....2................Z..e... .i..8J......(.D.o.v.o.d.e.m. .p.r.o. .t.o. .b.y. .m.o.h.l.o. .b...t.,. .~.e. .d.o.k.u.m.e.n.t.a.c.e. .j.e. .s.t...l.e. .j.e.a.t...

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\translations\qt_help_da.qm

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):4795
                                                                                                                                                                                                                                                      Entropy (8bit):4.530246422531362
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:96:X82wNlnKfN1LMFy7LsF3ZqBFZjWo0koBLqBXXjGL0qU7UqB7zoElmP5MUu4DZIHU:XM01f7eOnoB8X2s7Vfg5Mi4beXiOUu
                                                                                                                                                                                                                                                      MD5:1D09BEE1FB55A173F7EB39B9A662A170
                                                                                                                                                                                                                                                      SHA1:C77F0A148262A91679F19689E4790B754D45D5D5
                                                                                                                                                                                                                                                      SHA-256:6BB092552A398687119F6D52145F04BF8373977446D8F00C0DCBD56B96829F0F
                                                                                                                                                                                                                                                      SHA-512:BE5A31A6135E8DB024A8B0EB20C4D8EECBF76861F83FF83B4CA97327DB74AD94BB5D77B4E0A59A33B697C32A4EACD61B8C878951F2C545385C74D99FCE56FEE1
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:<.d....!..`.......daB.....%.....m.0T......Uj....V.`....................k.B<s.....B\>..........6.+.s...............t.....D ....|.k.N...9...I...O..2.......G....B...N...O..............!..K...._..........GN...........@.K.H.............pN..............>.....~.....m..%c.....z.q....i..........U.n.a.v.n.g.i.v.e.t..........Untitled.....QHelp.....D.K.a.n. .i.k.k.e. .k.o.p.i.e.r.e. .s.a.m.l.i.n.g.s.f.i.l.e.n.:. .%.1..........Cannot copy collection file: %1.....QHelpCollectionHandler.....6.K.a.n. .i.k.k.e. .o.p.r.e.t.t.e. .m.a.p.p.e.n.:. .%.1..........Cannot create directory: %1.....QHelpCollectionHandler.....V.K.a.n. .i.k.k.e. .o.p.r.e.t.t.e. .i.n.d.e.k.s.t.a.b.e.l.l.e.r. .i. .f.i.l.e.n. .%.1...........&Cannot create index tables in file %1......QHelpCollectionHandler.....J.K.a.n. .i.k.k.e. .o.p.r.e.t.t.e. .t.a.b.e.l.l.e.r. .i. .f.i.l.e.n. .%.1........... Cannot create tables in file %1......QHelpCollectionHandler.....P.K.a.n. .i.k.k.e. .i.n.d.l...s.e. .s.q.l.i.t.e.-.d.a.t.a.b.a.s.e.-.d.r

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\translations\qt_help_de.qm

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):7570
                                                                                                                                                                                                                                                      Entropy (8bit):4.550982634910665
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:96:8y/gPmmhL/7LlSivP6kBL7jb0RNUzzpld4UGG3Ik18fLP0L7fGc0OeVP8a8hiAwj:1OD7hx/Bv3oNuFX4iqgv34fZsu
                                                                                                                                                                                                                                                      MD5:3B070D169E3381E2FB081172934AAD00
                                                                                                                                                                                                                                                      SHA1:70886EB7EF566B296D0814BD4C2440AC176699D6
                                                                                                                                                                                                                                                      SHA-256:9962523FBAE9F1E4C3B5C3C16860D059291CB30DC5EBE5A5EDA4C836A03FED1E
                                                                                                                                                                                                                                                      SHA-512:271B730B5A7358E923BBBC6FA074A72DA52FA47E3B7726779EF7034200EDA09BF0E1AE4E7B11B59F76805F48DC285F6EFC245EB9C7F4A748BE82B25CEE1DDCAE
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:<.d....!..`.......deB..........B.%.....5.0T......K:^.....Uj....?.`.....f..YJ...V.E.4...............>............B<s...z.B\>...\........+.s...Q.zq....C..9....4..vR...B..@.......@.......:......8Z......g.N......F....>...........t.....D ......k.N.......I......^....|.`#....I..2....<..G....^...N.........................;..........K....y..........GN......NO...........,.K.H.............pN......V...................."..........>.............~........%c.....z.q....i........".F.i.l.t.e.r. .h.i.n.z.u.f...g.e.n..........Add Filter.....FilterNameDialogClass.....".N.a.m.e. .d.e.s. .F.i.l.t.e.r.s.:..........Filter Name:.....FilterNameDialogClass.......O.h.n.e. .T.i.t.e.l..........Untitled.....QHelp.....\.D.i.e. .K.a.t.a.l.o.g.d.a.t.e.i. .k.a.n.n. .n.i.c.h.t. .k.o.p.i.e.r.t. .w.e.r.d.e.n.:. .%.1..........Cannot copy collection file: %1.....QHelpCollectionHandler.....\.D.a.s. .V.e.r.z.e.i.c.h.n.i.s. .k.a.n.n. .n.i.c.h.t. .a.n.g.e.l.e.g.t. .w.e.r.d.e.n.:. .%.1..........Cannot create directory: %

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\translations\qt_help_en.qm

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):16
                                                                                                                                                                                                                                                      Entropy (8bit):4.0
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:3:j2wZC4n:CwZ
                                                                                                                                                                                                                                                      MD5:BCEBCF42735C6849BDECBB77451021DD
                                                                                                                                                                                                                                                      SHA1:4884FD9AF6890647B7AF1AEFA57F38CCA49AD899
                                                                                                                                                                                                                                                      SHA-256:9959B510B15D18937848AD13007E30459D2E993C67E564BADBFC18F935695C85
                                                                                                                                                                                                                                                      SHA-512:F951B511FFB1A6B94B1BCAE9DF26B41B2FF829560583D7C83E70279D1B5304BDE299B3679D863CAD6BB79D0BEDA524FC195B7F054ECF11D2090037526B451B78
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:<.d....!..`...

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\translations\qt_help_es.qm

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):10704
                                                                                                                                                                                                                                                      Entropy (8bit):4.481291573289571
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:192:q9J9j7e4BQhD0h61nnKz+DJF/45ojDU9V1Wa/rmtIBMH:Wp64ShDnnKz+FhjQpWa/ytoMH
                                                                                                                                                                                                                                                      MD5:9EDF433AB9EE5FC7CF7782370150B26A
                                                                                                                                                                                                                                                      SHA1:A918AE15A0DF187C7789BE8599A80E279F039964
                                                                                                                                                                                                                                                      SHA-256:FD16B279F8CF69077F75E94D90C9C07A2AFFF3948A579E3789F5FFB5E5F4202D
                                                                                                                                                                                                                                                      SHA-512:88245F6FBAAF603A03D7EA2341411AE040791D47C9FF110C6D6CDD8165F0A8BA7A4A0DA5CD543BBE95A4E93FE3A81E95B3664E00C11791FBCB4923E3A80ABC60
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:<.d....!..`.......es_ESB...(.(.....7.0T..../.5w... C.Uj......`.......a[....0..........t..............39..........&e.........B<s...D..M^..............J..%p.O5^...I..)^...1..o>.......J..%.......#....t.....8dz..$..D ......k.N.....k.N.......n.......I..............2>....................G...#...w............!.......%..,................^............$a......6.>..........#...K...........$C.W.b....._Xn......GN...|..~.......TH.."..!.....5.K.H..#f.........pN...j......'..P.~... .o........(....>....."<..~....c.s.>.....o.... ..z.q..........................u.h....!p.......*..e....Qi..'}......(.L.a. .r.a.z...n. .d.e. .e.s.t.o. .p.u.e.d.e. .s.e.r. .q.u.e. .l.a. .d.o.c.u.m.e.n.t.a.c.i...n. .a...n. .e.s.t... .s.i.e.n.d.o. .i.n.d.e.x.a.d.a...).........M(The reason for this might be that the documentation is still being indexed.).....QCLuceneResultWidget.......N.o.t.a.:..........Note:.....QCLuceneResultWidget.....2.R.e.s.u.l.t.a.d.o.s. .d.e. .l.a. .B...s.q.u.e.d.a..........Search Results.....QCLu

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\translations\qt_help_fr.qm

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):10922
                                                                                                                                                                                                                                                      Entropy (8bit):4.459946393010639
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:192:w4BIn67/WsmoB3r6M/eYlSbyE7DnvE7pcn9nPJZe7nOFovzcNn7Uhmio+2/p53I/:w4N19fq3n2c9Bucuhmi52/X3Qpam
                                                                                                                                                                                                                                                      MD5:D520C7F85CC06C66715A2B6622BF0687
                                                                                                                                                                                                                                                      SHA1:47292D068172FBC9DC0D9BE2F479E890A37CE138
                                                                                                                                                                                                                                                      SHA-256:687E351C062F688AAFF6CF05218D6017B80B1A1B4238D1D30250A55EE41C5FED
                                                                                                                                                                                                                                                      SHA-512:736B50BB64751B127300BCAFE88888A9D9A2081CBF934EDCFFEF6CEF0575505AFDF714273A97671ABB598AE3D23C8E55F7DCD632FB0AA219ED5F763768576E04
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:<.d....!..`.......fr_FRB...(.(.....y.0T....K.5w...!1.Uj....*.`.......a[............5..t..............39....m.....'W.......S.B<s...d..M^.. ...........J..&`.O5^...+..)^......o>.......J..&.......$....t.....8dz..%..D ......k.N.....k.N...D...n.......I...........c..2>..........M.........G...$...w....K..................,................^............$a......6.>...c......$...K....'......%M.W.b....._Xn...j..GN......~.......TH..#..!.......K.H..$Z......,..pN..........'..P.~.....o........(....h.....#4..~......s.>...M.o....!..z.q...........p......L.........h...."^.......b..e.....i..(W......(.I.l. .e.s.t. .p.o.s.s.i.b.l.e. .q.u.e. .c.e.l.a. .s.o.i.t. .d... .a.u. .f.a.i.t. .q.u.e. .l.a. .d.o.c.u.m.e.n.t.a.t.i.o.n. .e.s.t. .e.n. .c.o.u.r.s. .d.'.i.n.d.e.x.a.t.i.o.n...).........M(The reason for this might be that the documentation is still being indexed.).....QCLuceneResultWidget.......N.o.t.e. .:..........Note:.....QCLuceneResultWidget.....2.R...s.u.l.t.a.t.s. .d.e. .l.a. .r.e.c.h.e.r.c.h.e.

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\translations\qt_help_gl.qm

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):10891
                                                                                                                                                                                                                                                      Entropy (8bit):4.5087667371046205
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:192:Im7gBZHx4hCTNarW6EJDvoIR765f40wqNcMi/8F/Ihon:v0fHccarW6Eh61wqNcMi/Q/won
                                                                                                                                                                                                                                                      MD5:B62C74793741FC386332A59113E8D412
                                                                                                                                                                                                                                                      SHA1:589CE099F2C1D92581B5CF0E17BE49A2BF0014D4
                                                                                                                                                                                                                                                      SHA-256:7399A248609974773F60866C87B78EA7DFBC4F750313D692F7886CD763883C9F
                                                                                                                                                                                                                                                      SHA-512:D8E1A3B3732662BA572A1387651F2625742710834BEDB41809DA47B5D23020AA1B558B64A00C10C605D1844F0544483163F4A6227CAFFA5ECDABF3BBF4E12D9B
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:<.d....!..`.......gl_ESB...8.(.......0T......Uj......`.....`.a[....F..........t..............1"... S.39.......s...!.............'F.........B<s...8..MQ.. ...........J..&S.0.....x.O5Q......)Q...O..o>...{.......#...J..&.......$....t.....8dz..%..D ......k.A.....k.A.......n.......I.................."...21....................G...#...w............[...!...?...........Q...?........$a....v.6.>..........$...K...........%0._Xa......GA...n..........~.......TH..#..K.H..$M.........pA...Z......'..P.~...B.o........(..........#+..~......s.1.....o....!..z.q...e.............................. ..e....wi..((......(.A. .r.a.z...n. .d.i.s.t.o. .p.o.d.e. .s.e.r. .q.u.e. .a. .d.o.c.u.m.e.n.t.a.c.i...n. .a...n.d.a. .e.s.t.e.a. .a. .i.n.d.e.x.a.r.s.e...).........M(The reason for this might be that the documentation is still being indexed.).....QCLuceneResultWidget.......N.o.t.a.:..........Note:.....QCLuceneResultWidget.....*.R.e.s.u.l.t.a.d.o.s. .d.a. .p.r.o.c.u.r.a..........Search Results.....QCLucene

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\translations\qt_help_hu.qm

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):10284
                                                                                                                                                                                                                                                      Entropy (8bit):4.674501432335502
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:192:RNY+rCG3e7LBqYqYseBb/FEWBgSn62TdJgDO9esYGY3DtgGh621XlZ/8kWvIMK:4+rheHYYZdBb/pgSn62T/FeVD3DGGh62
                                                                                                                                                                                                                                                      MD5:5A56E9E2ED6ECE3F249D1C2A7EB3B172
                                                                                                                                                                                                                                                      SHA1:D6F079F40FBB813B0293C1D2210BAE7084092FEC
                                                                                                                                                                                                                                                      SHA-256:70F33B569C2942F41C6D634EA6A61CB8D80EB2C7011BAD48EF6DBAE9677960D5
                                                                                                                                                                                                                                                      SHA-512:28947128FC51791CFDBFD3958FAF9B33979DB52C90AE0159EDB01FE6032284EB37BC05187162983A0435560BCEA864B008F499CDB4CE662792599FE20A37972A
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:<.d....!..`.......hu_HUB...(.(.......0T......5w......Uj......`.....4.a[....N..........t....".........39..........%..........B<s...8..M^...8..........J..$..O5^......)^...]..o>.......J..$......."N...t.....8dz..#g.D ......k.N...>.k.N.......n.......I..............2>..........a.........G...!...w.......................,................^............$a......6.>.........."...K....m......"..W.b...l._Xn...~..GN......~.......TH..!F.!.......K.H..!..........pN..........%..P.~...<.o........(.......... ...~......s.>...{.o.....c.z.q...K.......v......l.........h.... ........t..e....mi..%.....~.(.E.z. .a.m.i.a.t.t. .l.e.h.e.t.,. .h.o.g.y. .a. .d.o.k.u.m.e.n.t...c.i... .m...g. .i.n.d.e.x.e.l...s. .a.l.a.t.t. .v.a.n...).........M(The reason for this might be that the documentation is still being indexed.).....QCLuceneResultWidget.......M.e.g.j.e.g.y.z...s.:..........Note:.....QCLuceneResultWidget.....&.K.e.r.e.s...s.i. .e.r.e.d.m...n.y.e.k..........Search Results.....QCLuceneResultWidget.......A

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\translations\qt_help_it.qm

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):10612
                                                                                                                                                                                                                                                      Entropy (8bit):4.458970627057882
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:192:nRxcfy71b+myBN16cbc+w45rtlTnzo7uHp3JQJ9cVu4BJ1G82g33vOVrNL/7nEF1:RR4R/fJn9JizTgnqrNL/b0hH2K
                                                                                                                                                                                                                                                      MD5:3639B57B463987F6DB07629253ACD8BF
                                                                                                                                                                                                                                                      SHA1:65935A67C73F19FCF6023FB95030A5ACAF9DA21C
                                                                                                                                                                                                                                                      SHA-256:316FE8D0815E2B4B396895BEB38EF1A40431915B5E054DF80F4C0CD556F26E4B
                                                                                                                                                                                                                                                      SHA-512:AD7CA93D93A69F273CE80BE7F2F477543B9C5F9C7E4D7448223BFF084EA956B626D6837F22D83C5E282688B938F58C29073C4B5C6F26A797F716C14FABF9FFEE
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:<.d....!..`.......it_ITB...(.(.....g.0T....y.5w... ..Uj....2.`.......a[............'..t..............39..........&..........B<s...j..M^...h......K...J..%..O5^...K..)^......o>...u...J..%.......#....t.....8dz..$..D ......k.N.....k.N.......n.......I..............2>.................o..G..."...w............-......./..,................^...'........$a......6.>..........#...K...........$..W.b....._Xn......GN......~.......TH.."n.!.....5.K.H..#"......>..pN..........&..P.~.....o.....~..(....p.....!...~....A.s.>.....o.... ..z.q..........................q.h....!0.......*..e....;i..'!......(.L.a. .c.a.u.s.a. .d.i. .c.i... .p.o.t.r.e.b.b.e. .e.s.s.e.r.e. .c.h.e. .l.'.i.n.d.i.c.i.z.z.a.z.i.o.n.e. .d.e.l.l.a. .d.o.c.u.m.e.n.t.a.z.i.o.n.e. ... .a.n.c.o.r.a. .i.n. .c.o.r.s.o...).........M(The reason for this might be that the documentation is still being indexed.).....QCLuceneResultWidget.......N.o.t.a.:..........Note:.....QCLuceneResultWidget.......R.i.s.u.l.t.a.t.i. .d.e.l.l.a. .r.i.c.e.r.c.

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\translations\qt_help_ja.qm

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):7917
                                                                                                                                                                                                                                                      Entropy (8bit):5.680408580146589
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:192:mP6J37GcBzRjYEPEJJGTnwfJJxb7FTPjzzZBL3/q/I53:mSVqclR5s6Tnwfb7Pj/PL3/q/w3
                                                                                                                                                                                                                                                      MD5:1380A9352C476071BDA5A5D4FED0B6C5
                                                                                                                                                                                                                                                      SHA1:9B737ED05F80FE5D3CD8F588CCEC16BB11DD3560
                                                                                                                                                                                                                                                      SHA-256:AE603B2C0D434D40CDE433FFCBA65F9EE27978A9E19316007BE7FE782A5B8B47
                                                                                                                                                                                                                                                      SHA-512:EC3D68126488C3A163898BACAF7E783217868573635182CAF511ED046B4BE1F99A71FBB24DA607CCB50EDAF70893007AAEE9A6BAAE4C1CD33465A0915AA965DA
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:<.d....!..`.......jaB...(.(.....S.0T......5w....'.Uj......`.......a[............u..t............!.39.....................B<s......M^..............J...>.O5^...O..)^......o>.......J...............t...w.8dz.....D ......k.N.....k.N...H...n.......I...........i..2>...<......G......9..G....P..w............i..........,................^..........'.$a......6.>...5..........K............S.W.b...2._Xn......GN...@..~.......TH.....!.......K.H.............pN...........S.P.~.....o.....|..(..............~....o.s.>.....o.......z.q..................@.........h.....&....... ..e.....i........@.(0.0.0.0.0.0.0n}"_.0nO\b.0L}BN.0W0f0D0j0D0_0.0K0.0W0.0~0[0.0..).........M(The reason for this might be that the documentation is still being indexed.).....QCLuceneResultWidget......l..:..........Note:.....QCLuceneResultWidget......i.}"}Pg...........Search Results.....QCLuceneResultWidget.....R0.0.0.0.0.0.0n}"_.0nO\b.0L}BN.0W0f0D0j0D0_0.0.i.}"}Pg.0LN.[.Qh0jS..`'0L0B0.0~0Y0..........VThe search results may

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\translations\qt_help_ko.qm

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):5708
                                                                                                                                                                                                                                                      Entropy (8bit):5.698914195742074
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:96:elPQHJ6L4c7LaQaFQv2QEhBL+Ejma0W40U0BzlQlcrnUSaTIdspIc18CLRSM3LBY:dHI97W1BbNz1VqqzJpoj5y5uY7OGrWFE
                                                                                                                                                                                                                                                      MD5:CD15674A652C2BF435F7578E119182F8
                                                                                                                                                                                                                                                      SHA1:AEA22E4A0D21396733802C7AB738DDD03737B7D6
                                                                                                                                                                                                                                                      SHA-256:F11C64694E8E34E1D2C46C1A1D15D6BA9F2DB7B61DE4FDF54ECA5AB977C3E052
                                                                                                                                                                                                                                                      SHA-512:88BFA112F4DBC0BFB4013CE0937E5180B4AB4A217FC8A963798C7C86532E794E4A1AD88416AE42F26A1C0631B465A5D69BFE75366E048502F5E21F4115A12F19
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:<.d....!..`.......koB............%.......0T......K:^...g.Uj......`........YJ...>.E.4...........z...>..........;.B<s...K.B\>...b........+.s.....zq....[..9....F..vR......@.......@.......:....c.8Z......g.N...7..F....|...........t.....D ......k.N.......I...m..^......`#....!..2.......G....@...N.................................X..K....{.......i..GN......NO.............K.H..........S..pN...z..V...............................>...........:.~.....i..%c.....z.q....i...s......D.0. .............Add Filter.....FilterNameDialogClass.......D.0. .t...:..........Filter Name:.....FilterNameDialogClass........... ...L..........Untitled.....QHelp.....(...L... ...|.D. .....`. ... ...L.:. .%.1..........Cannot copy collection file: %1.....QHelpCollectionHandler.....".....0...|. .... ... ...L.:. .%.1..........Cannot create directory: %1.....QHelpCollectionHandler.....2...|. .%.1... ...x. .L.t...D. .... ... .................&Cannot create index tables in file %1......QHelpCollectionHandler.....,.

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\translations\qt_help_pl.qm

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):9673
                                                                                                                                                                                                                                                      Entropy (8bit):4.622652249027856
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:192:TO/7kBL9wGu3wtCnlhLJUBB7oph+mZ18LgP:T8QnwcCnlhdvphpZ18LgP
                                                                                                                                                                                                                                                      MD5:2B68446B69D9AA40B273D75A581D2992
                                                                                                                                                                                                                                                      SHA1:8A09BD38998543B74E2673478EDD54FB4BBDD068
                                                                                                                                                                                                                                                      SHA-256:CC6CB4D8C54086224672F2E49E623C8CB7C0C1CD65B8D5ECD42FC9BA3A6065BD
                                                                                                                                                                                                                                                      SHA-512:F3A3D6A416B3411613B06FC3EE56625D4D4DE80087182AB0D0601E49314861ABEF97D11A15B4C0511911544A59FBC4A4A52F0CCF0FD43F763A76A8922D8E57B6
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:<.d....!..`.......plB.....(.......0T....T.5w......Uj... R.`.......a[...............t............2.39....H......6.......n.B<s.. ...M^..._......6.O5^...F..)^......o>...............t.....D ......k.N.....k.N.../...n.......I...W..........2>...w................G.......w............&.......:..,................^...(..... ..$a....?.6.>...$..........K......W.b....._Xn......GN...Y..~......!.....*.K.H...E....."...pN...-.........P.~...}.o........(....1..~......s.>......%c.."..o.....r.z.q............................h................e.....i..#.......N.i.e.n.a.z.w.a.n.y..........Untitled.....QHelp.....P.N.i.e. .m.o.|.n.a. .s.k.o.p.i.o.w.a... .p.l.i.k.u. .z. .k.o.l.e.k.c.j...:. .%.1..........Cannot copy collection file: %1.....QHelpCollectionHandler.....>.N.i.e. .m.o.|.n.a. .u.t.w.o.r.z.y... .k.a.t.a.l.o.g.u.:. .%.1..........Cannot create directory: %1.....QHelpCollectionHandler.....H.N.i.e. .m.o.|.n.a. .u.t.w.o.r.z.y... .t.a.b.e.l. .w. .p.l.i.k.u. .%.1........... Cannot create tables in file

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\translations\qt_help_ru.qm

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):7288
                                                                                                                                                                                                                                                      Entropy (8bit):5.297177914619657
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:192:dBJjvfq7D6X68uBAzlp5W9+yBPZZZMM7vL0PXJL:JKrMEL0PXJL
                                                                                                                                                                                                                                                      MD5:794AF445A5D7082D51BD22683449F86D
                                                                                                                                                                                                                                                      SHA1:3A0C369872B112A1572AA17EEB814B168B225D98
                                                                                                                                                                                                                                                      SHA-256:557B644E6DA5F1EC720EF93965617087E4D1F40B2494CC5AA524CF3796108DE7
                                                                                                                                                                                                                                                      SHA-512:D42C870A16AEE7626BBE24886AD423895529A2F1A51AC2DBC303BC0E4EF9D3241FE894ECA3F7217AD408C8DCEE165CA4B89D84570357B0EB80340A3F72B0A846
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:<.d....!..`.......ruB..........\.%.......0T......K:^.....Uj....L.`........YJ...X.E.4...............>............B<s.....B\>............+.s.....zq.......9....B..vR...L..@.......@....G..:......8Z......g.N......F....>...........t.....D ....R.k.N...E...I...W..^......`#....s..2.......G....^...N.........................K.......d..K............O..GN...b..NO.............K.H.............pN...P..V....................g..........>.............~........%c.....z.q....i........$...>.1.0.2.;.5.=.8.5. .D.8.;.L.B.@.0..........Add Filter.....FilterNameDialogClass.........<.O. .D.8.;.L.B.@.0.:..........Filter Name:.....FilterNameDialogClass.........5.7.K.<.O.=.=.K.9..........Untitled.....QHelp.....b...5. .C.4.0.;.>.A.L. .A.:.>.?.8.@.>.2.0.B.L. .D.0.9.;. .:.>.;.;.5.:.F.8.8. .A.?.@.0.2.:.8.:. .%.1..........Cannot copy collection file: %1.....QHelpCollectionHandler.....<...5. .C.4.0.;.>.A.L. .A.>.7.4.0.B.L. .:.0.B.0.;.>.3.:. .%.1..........Cannot create directory: %1.....QHelpCollectionHandler.....`

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\translations\qt_help_sk.qm

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):10388
                                                                                                                                                                                                                                                      Entropy (8bit):4.70568613551943
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:192:uPq7iBWseXKkVu4+Qv9zEJ1xGMaLNmBgJqdC6/MxIMt:LWcseV04Xv9zEoLNDJqdX/MxRt
                                                                                                                                                                                                                                                      MD5:75C94E59F1FC5312AE25381C247AF992
                                                                                                                                                                                                                                                      SHA1:E3E5F4582CC5FAFE6DF43644D11484861023C084
                                                                                                                                                                                                                                                      SHA-256:F41E33E1D790BD0D3EB180F1F875BC191FE74773628F25C2CAD95E1402E66867
                                                                                                                                                                                                                                                      SHA-512:959B8F4D57FC9728DD4804322333D1792D45A0EE85615B559E0CA3BD2DEA22E2C8C68C6482AE9425D29C819B0ED27473EDDC82EF4B6ECFFB2E2E7B56E1509B63
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:<.d....!..`.......sk_SKB...8.(.......0T......Uj......`.....0.a[....8..........t..............1"......39.......s........... .....%..........B<s...6..MQ..............J..$-.0.......O5Q......)Q...;..o>...........G...J..$......."....t.....8dz..#..D ......k.A...2.k.A.......n..._...I.................. ...21..........e.........G...!...w....Y...........!...........=...Q............$a......6.>.........."...K....i......# ._Xa..."..GA..............~.......TH..!{.K.H.."7.........pA..........%..P.~.....o........(..........!...~....u.s.1.....o.......z.q...c..............................f..e....9i..&-......(.D...v.o.d.o.m. .m...~.e. .b.y.e. .t.o.,. .~.e. .d.o.k.u.m.e.n.t...c.i.a. .s.t...l.e. .n.i.e. .j.e. .z.i.n.d.e.x.o.v.a.n.....).........M(The reason for this might be that the documentation is still being indexed.).....QCLuceneResultWidget.......P.o.z.n...m.k.a.:..........Note:.....QCLuceneResultWidget.....".V...s.l.e.d.k.y. .h.>.a.d.a.n.i.a..........Search Results.....QCLuceneResultWidg

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\translations\qt_help_sl.qm

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):10363
                                                                                                                                                                                                                                                      Entropy (8bit):4.613473842638716
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:192:vNBqTi7qBCVIQf54EslZ2Jy/L/BnmpP0bX3caK6q1B6/hgIlCCUb0:vjq2+UVT4ESZOYmpP0bX26q1I/yqCCUw
                                                                                                                                                                                                                                                      MD5:3B0AEE27B193A8A563C5CB5C7C4FE60F
                                                                                                                                                                                                                                                      SHA1:C94E832595EC765370553468F87C02DB7E7D138A
                                                                                                                                                                                                                                                      SHA-256:2EC955E662407EBCD8DCDAE5AAA21E4108E0B5B0AEE0E9DB712C27072943535F
                                                                                                                                                                                                                                                      SHA-512:EBC25C378126876F44279E23CA0CF06FC9E7D5F51AD7E3DBDABA7A50C81112EDC1C76F7FD0AF47E447A93C3593BB953A0C9C1FBBFC49494E6B29BF21655F690E
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:<.d....!..`.......slB...8.(.....E.0T......Uj......`.......a[............!..t..............1"....;.39.......s....^............$........i.B<s...,..MQ..........}...J..#..0.....Z.O5Q...[..)Q......o>...............J..$I......"W...t...C.8dz..#H.D ......k.A.....k.A.......n.......I.................. P..21....................G...!...w............?...!...3...........Q...+........$a....>.6.>.........."...K...........".._Xa......GA..............~....A..TH..!I.K.H..!..........pA...>......%..P.~...>.o........(....d..... ...~......s.1.....o.......z.q.....................................e....{i..&.....z.(.R.a.z.l.o.g. .j.e. .m.o.r.d.a. .t.o.,. .d.a. .s.e. .d.o.k.u.m.e.n.t.a.c.i.j.o. .a.e. .v.e.d.n.o. .i.n.d.e.k.s.i.r.a...).........M(The reason for this might be that the documentation is still being indexed.).....QCLuceneResultWidget.......O.p.o.m.b.a.:..........Note:.....QCLuceneResultWidget.....".R.e.z.u.l.t.a.t.i. .i.s.k.a.n.j.a..........Search Results.....QCLuceneResultWidget.......R.e.

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\translations\qt_help_tr.qm

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):4629
                                                                                                                                                                                                                                                      Entropy (8bit):4.68793836539357
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:96:BoiK0UD2wMLb7Lqlguotqbww5BLNwWjK0kHU9zuQlUVUfniqthweEIFwC18lLEGA:PXFf7pU75BWWOpcJcVqDFNz8brgyf76r
                                                                                                                                                                                                                                                      MD5:32D6EE3D8EE6408A03E568B972F93BCB
                                                                                                                                                                                                                                                      SHA1:582EE079DBD42000C378E0701D26405750524DBA
                                                                                                                                                                                                                                                      SHA-256:EBDECA0CFEE7A9441DEB800BABFD97C63BC4E421DA885C55B3BD49725EBACD25
                                                                                                                                                                                                                                                      SHA-512:24AAA30B9CB4DB82A57411FBA24A87D70D8B845AE48A6FDA633D0BE6B824B58FDD2F450C2B385F16F49E2F9C6FA0A3124FD0F28594726940F996C66F8F3216CC
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:<.d....!..`.......tr_TRB.....%.....[.0T......Uj......`.....$..............L.B<s.....B\>..........4.+.s...............t.....D ......k.N...5...I......2.......G....5...N..........a...............f..K....9..........GN...........@.K.H..........q..pN...t..........>...z.~...../..%c.....z.q....i..........B.a._.l.1.k.s.1.z..........Untitled.....QHelp.....J.K.o.l.e.k.s.i.y.o.n. .d.o.s.y.a.s.1. .k.o.p.y.a.l.a.n.a.m.1.y.o.r.:. .%.1..........Cannot copy collection file: %1.....QHelpCollectionHandler.....2.D.i.z.i.n. .o.l.u._.t.u.r.u.l.a.m.1.y.o.r.:. .%.1..........Cannot create directory: %1.....QHelpCollectionHandler.....\.%.1. .d.o.s.y.a.s.1.n.d.a. .d.i.z.i.n. .t.a.b.l.o.l.a.r.1. .o.l.u._.t.u.r.u.l.a.m.1.y.o.r...........&Cannot create index tables in file %1......QHelpCollectionHandler.....N.%.1. .d.o.s.y.a.s.1.n.d.a. .t.a.b.l.o.l.a.r. .o.l.u._.t.u.r.u.l.a.m.1.y.o.r........... Cannot create tables in file %1......QHelpCollectionHandler.....P.S.q.l.i.t.e. .v.e.r.i.t.a.b.a.n.1. .s...r...c...

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\translations\qt_help_uk.qm

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):9750
                                                                                                                                                                                                                                                      Entropy (8bit):5.281035122342072
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:192:eMp79BCN+u8hhbHbny+HJouHgei50JBSfDvbetpP/RIkT:eIhgNgBbny+phiS3SfDDetpP/RRT
                                                                                                                                                                                                                                                      MD5:90A776917D534B65942063C319573CDC
                                                                                                                                                                                                                                                      SHA1:5DF3B213D985A3BBDB476B37B7780D7D7DF17E41
                                                                                                                                                                                                                                                      SHA-256:497CFC473684692EE44D7A3795E8FB2270C57069FD9EB98A615DD29AB9BE8A7C
                                                                                                                                                                                                                                                      SHA-512:B34A019716B50CE8E1E20AC32756B3B0D5802971F7A04F4BDDE2418DA551AFB9742B79E934979DB6FAB9DAC05D7D26A3B19ABA77158321F8D9AAB08AEBBD455A
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:<.d....!..`.......uk_UAB...(.(.....?.0T......5w......Uj......`.......a[...............t............K.39....u....."..........B<s...8..M^...j......y...J..!..O5^...Y..)^......o>...o...J..":...... <...t...E.8dz..!3.D ....".k.N.....k.N...d...n.......I..............2>...>......o.........G.......w............E.......e..,................^...S........$a......6.>...'...... y..K........... ..W.b....._Xn......GN...p..~.......TH...4.!.....9.K.H.............pN..........#].P.~...~.o.....N..(....b.........~......s.>.....o.....o.z.q..........................U.h.............D..e.....i..#.......(...@.8.G.8.=.>.N. .F.L.>.3.>. .<.>.6.5. .1.C.B.8. .B.5.,. .I.>. .4.>.:.C.<.5.=.B.0.F.V.O. .4.>.A.V. .V.=.4.5.:.A.C.T.B.L.A.O...).........M(The reason for this might be that the documentation is still being indexed.).....QCLuceneResultWidget.........@.8.<.V.B.:.0.:..........Note:.....QCLuceneResultWidget.....". .5.7.C.;.L.B.0.B.8. .?.>.H.C.:.C..........Search Results.....QCLuceneResultWidget....... .5.7

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\translations\qt_help_zh_CN.qm

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):6441
                                                                                                                                                                                                                                                      Entropy (8bit):5.790303416386852
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:192:pB37nBD4H5PCyLDxLSzJPduYx9vja/FIgH9yIFqfs:rTZ4HUAD1S1JFe/F59PFqfs
                                                                                                                                                                                                                                                      MD5:9297A6905B8B1823BF7E318D9138A104
                                                                                                                                                                                                                                                      SHA1:3DB992A1B3BBCAF314B7EA4A000D6334D7492A52
                                                                                                                                                                                                                                                      SHA-256:C02AAA20923F18ADDAB520BE5CB84EFD4C723396BDC24B4C9A72D406F101C7B4
                                                                                                                                                                                                                                                      SHA-512:01F12CEE0AE456D78942A6049E1C77F94B406C8FFB4A5944DE15E54D1C760CDBA13279530A8F29B1443D1BBC647D3AF5436AAD8C43EB3944316C48300B3827E4
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:<.d....!..`.......zhB......I....L.0T......Uj......`.......a[...............t....P..@....Z.......<.........39.......s....2.................B<s......MQ..........9...J......31.....0.......O5Q......)Q...^..o>...........(...........J...V...........t.....8dz.....D ....Z.k.A.....k.A.......n.......I...........t..w................!...........o.......D...Q...E........$a......6.>...h...............%._Xa......GA..........._..TH...r.........pA.............P.~.....o.....].~.q.............~......o.....h.z.q...........H..0q....................i........2..S.u...y.`.Q.v.S.V.S..f/V.N:..e.hckcW(..}"_.0............M(The reason for this might be that the documentation is still being indexed.).....QCLuceneResultWidget......l..............Note:.....QCLuceneResultWidget......d.}"~.g...........Search Results.....QCLuceneResultWidget.....,d.}"~.g.N_..^vN.[.et..V.N:..e.hckcW(..}"_............VThe search results may not be complete since the documentation is still being indexed!.....QCLuceneResultWidget..

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\translations\qt_help_zh_TW.qm

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):9301
                                                                                                                                                                                                                                                      Entropy (8bit):5.80411750798786
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:192:4bgIXwsL78BQp4dRDP0ludqODa/wkB/tTWn5dJ6mO8IZiT9Dzz/wI3HyRWqUqS:lI/oS4dR5c/tTWn5/EZA9D/w+H8WqUqS
                                                                                                                                                                                                                                                      MD5:47C3328D3918CF627112BB6C50E30B86
                                                                                                                                                                                                                                                      SHA1:05705603AB3F28402A6C103E1C41DDFF21D140C0
                                                                                                                                                                                                                                                      SHA-256:3697F1660D7F2AC9B37AC33CD1C7ECAE08ADBD26710E7E0076497CCDDC8BC830
                                                                                                                                                                                                                                                      SHA-512:8DE1C3C5A48965CF6D8AA545DA9F0A5C00AE124F3E4153597915E7C0F4CAE1E26723270F58A47AA9FFA4AAF30E6EBA522D4EBAD27DECF17EF108E353E611980E
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:<.d....!..`.......zh_TWB......I....[.%.......0T......0T......Uj......Uj....R.`.....>.a[....................g..t....7..@......................39.......s................... .........B<s.....B<s.....B\>......MQ..........[...J...]..31.....+.s...c.0.....U.O5Q......)Q...C..o>.......................J...............t...3...t.....8dz.....D ....R.D ......k.A.....k.A.....k.N...'...n.......I.......I...........[..2....x..G........N......w................!...........:...........Q...&...............$a......6.>...I.......L.......$..K......................_Xa...y..GA...O..GN...........$..........TH...I.K.H................ Y..pA...K..pN.............P.~.....o.....D.~.q......>.............~......~........%c.. ..o.....!.z.q...........#..0q....................i..!Y....(..g.S..f/V.p.N.W(^.z.e.N.v.}"_.uvN-0............M(The reason for this might be that the documentation is still being indexed.).....QCLuceneResultWidget......P..;............Note:.....QCLuceneResultWidget......d.\.}Pg...........Sea

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\translations\qt_hu.qm

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):146
                                                                                                                                                                                                                                                      Entropy (8bit):3.6255640074603277
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:3:j2wZC4C/IrLlAlHekfK/gp1MUXaMlI+rwtbWlMiayIPldkOgn:CwDrC+TYIUrIRt6HoiHn
                                                                                                                                                                                                                                                      MD5:5A46979B45C67DD6312F33CCEA2ED7BC
                                                                                                                                                                                                                                                      SHA1:4C56836B1FB10D9903B299CBCB925947D515B4C8
                                                                                                                                                                                                                                                      SHA-256:BB246AABD501E14CED8B1FFC1369E3D5D26567AAE62B3EAD4D94C22FB77C3471
                                                                                                                                                                                                                                                      SHA-512:BDBA4E1731CF254E95B0F1337410937C765E96FBB1D42F1D053033E1511FEE6F50C02705F781F4DAA0347E2299DC78A5A9942AC4EA343ED1F8F401F9ACD961E4
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:<.d....!..`.......hu....v.....q.t.b.a.s.e._.h.u.....q.t.s.c.r.i.p.t._.h.u.....q.t.m.u.l.t.i.m.e.d.i.a._.h.u... .q.t.x.m.l.p.a.t.t.e.r.n.s._.h.u

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\translations\qt_it.qm

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):153
                                                                                                                                                                                                                                                      Entropy (8bit):3.5752972123113778
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:3:j2wZC4C/EbFlAlHeke5zOp1MUWLt7KlI+rwtbWlMj5FKIPldkOA9kk:CwDM+35aIUW5SIRt6Q50oi9Gk
                                                                                                                                                                                                                                                      MD5:2BB8C94D420D3BC344C79A01043BDC89
                                                                                                                                                                                                                                                      SHA1:3FBA773D58E6D3699C20AB41AEE6801E71E2DDAE
                                                                                                                                                                                                                                                      SHA-256:9117AAC2D07BC86DFA55A29B8825ED27C7093300FCC90E143E135E00E85F09D7
                                                                                                                                                                                                                                                      SHA-512:C6B13655AFB206B0056F5656B4A9BF33CC267FCC928F6973258131CFA6443970510226FE45A041E5AA988809E17D0B11C7458F4A241C71521EDED186596C6055
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:<.d....!..`.......it....v.....q.t.b.a.s.e._.i.t.....q.t.s.c.r.i.p.t._.i.t.....q.t.m.u.l.t.i.m.e.d.i.a._.i.t... .q.t.x.m.l.p.a.t.t.e.r.n.s._.i.t.......

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\translations\qt_ja.qm

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):146
                                                                                                                                                                                                                                                      Entropy (8bit):3.599979504080125
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:3:j2wZC4C/il/lAlHekd6hY1MUV6JAlI+rwtbWlMgel3UlIPldkOG:Cwz4+pjUGAIRt6qVUloiB
                                                                                                                                                                                                                                                      MD5:8A1EE3433304838CCD0EBE0A825E84D8
                                                                                                                                                                                                                                                      SHA1:2B3476588350C5384E0F9A51FF2E3659E89B4846
                                                                                                                                                                                                                                                      SHA-256:23457CE8E44E233C6F85D56A4EE6A2CECD87C9C7BDDE6D8B8A925902EED1CD9C
                                                                                                                                                                                                                                                      SHA-512:2D8ACD668DF537E98B27161F9FA49828EB2EB6E9CF41DB38E7F5D31F610D150CD1B580A8AE9B472A4DFDE4D4BF983C24A56293BB911CF5879368664E4D4CF3D2
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:<.d....!..`.......ja....v.....q.t.b.a.s.e._.j.a.....q.t.s.c.r.i.p.t._.j.a.....q.t.m.u.l.t.i.m.e.d.i.a._.j.a... .q.t.x.m.l.p.a.t.t.e.r.n.s._.j.a

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\translations\qt_ko.qm

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):146
                                                                                                                                                                                                                                                      Entropy (8bit):3.652277257665055
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:3:j2wZC4C/rrr/lAlHekcQ/01MUUQMlI+rwtbWlMhQGlIPldkORn:CwCC+1Q/UUpIRt6SBloimn
                                                                                                                                                                                                                                                      MD5:7B2659AF52B824EAC6C169CDD9467EE9
                                                                                                                                                                                                                                                      SHA1:5727109218B222E3B654A8CC9933E970EB7C2118
                                                                                                                                                                                                                                                      SHA-256:4CC1AF37E771F0A43898849CFF2CD42A820451B8D2B2E88931031629D781DB05
                                                                                                                                                                                                                                                      SHA-512:E9475AC80BDBBEFF54F2724A2B6BA76992F18FD1913FD8EE1540A99FD7A112B79FED5A130B6AC6D7460E4420C06354FC6E4CF7770A7C6CBD3EAC1BDAF0082DE5
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:<.d....!..`.......ko....v.....q.t.b.a.s.e._.k.o.....q.t.s.c.r.i.p.t._.k.o.....q.t.m.u.l.t.i.m.e.d.i.a._.k.o... .q.t.x.m.l.p.a.t.t.e.r.n.s._.k.o

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\translations\qt_lt.qm

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):165383
                                                                                                                                                                                                                                                      Entropy (8bit):4.805977227348512
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:1536:i5v3+zmayloj6yJjhnBAbnrKnGrhA7WgdXclIsooY9i:SvOzAloj6yJ9BA7riGr+7WKXc+s5ui
                                                                                                                                                                                                                                                      MD5:8992B652D1499F5D2F12674F3F875A35
                                                                                                                                                                                                                                                      SHA1:E22766A49612F79156C550D83C6C230345DDA433
                                                                                                                                                                                                                                                      SHA-256:47EB5F97467DF769261421D54A5BEA1131C9FB9B6388791D38BB6574335B64BF
                                                                                                                                                                                                                                                      SHA-512:9B8B6DBFF432F2A46C14BC183A6BAF84ACBF02BF2C5BB8C306C6538FBD9BE1C0A9015BD46728F2F652F9163AFC56B1E16D16EB95D8F7728F3C562AE9F4F1AE1E
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:<.d....!..`.......ltB..0X...*..)C...+...|......P....@..9....A..9....B..:....C..:....D..;....E..;....F..<6...G..<....H..=)...I..=....P..>q...Q..>....R..?....S..@f...T..@....U..A\...V..B....W..B....X..C....Y..Cy...]..k....t..........t>......th......t.......pd...;..J'...;.._h...;.......;...{...;..J....;...)...M..l....O...R...O...............}..l9...m..lo......^S..(5..P{..+;..4...+;......+;......+O..4...+O......1...^...E@..?p..F...C...H4......HY......H.......I...D...I@..s...IA..t...IC...2..J.......J....Y..J.......J.......K...9...LD...`..L.......PS......R.......T...q...Zr...`..[`......[`..&@..\....e..\....b.._......._....P..1........E..........5........L..1...O...1...PP......7......../...........$.......$.......,.......y.......y..........K^..............x......8................L...E.......E.......E..*....................%..:....%.........0U.....W......Zo.....^....5.......0..I....0...F...0...|...0.......0.......0..+\...5...}.......... D...g.. D......+....j..,.......,.......<U...+..<U

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\translations\qt_lv.qm

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):89
                                                                                                                                                                                                                                                      Entropy (8bit):4.156834975253888
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:3:j2wZC4C/HzllldQlHekbxplUp1MUTJ+b:Cwv+DIUEb
                                                                                                                                                                                                                                                      MD5:19F1B919BB531E9E12E7F707BEBD8497
                                                                                                                                                                                                                                                      SHA1:46E82683CEA28D877C73A5CE02F965BB1130FC62
                                                                                                                                                                                                                                                      SHA-256:03467738042A15676E504BA02CB326DCDB773B171FADA3CD62B7A0E0564314A0
                                                                                                                                                                                                                                                      SHA-512:901D7B26CAC7A4D0FFDB39A1D25767B5BC71BED4AFBE788D70BF19D4C58A8295167111675AB45E743FDF4768AF874D69417414C01CF23D5C525A3F6C8BF7D21F
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:<.d....!..`.......lv....0.....q.t.b.a.s.e._.l.v.....q.t.s.c.r.i.p.t._.l.v........)....

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\translations\qt_pl.qm

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):161
                                                                                                                                                                                                                                                      Entropy (8bit):3.8693516202048612
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:3:j2wZC4C/5J/p/lAlHekHp/7KlI+rwtbWlM6Tl/z21MUPp/FOlIPldkOjehB:Cwr+26IRt6nFURkloiT
                                                                                                                                                                                                                                                      MD5:D71EA9FEFD97464B178235150EC8759E
                                                                                                                                                                                                                                                      SHA1:61026FE602FD1B8B442A0D341C6BD759EEC75488
                                                                                                                                                                                                                                                      SHA-256:BD7DD0C2CAB119A973DC10C3BFF7499D9728B928B541F86056921B30C8DB78E6
                                                                                                                                                                                                                                                      SHA-512:ECD76A7D8B8D733E635B2BFEA90A4CD387B83D9D8A4EB6D299F59FF22AAA8D617A4C886A825A1CDDD901925C7839E2C18BDD4E0CD84152641922B66B62663F77
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:<.d....!..`.......pl....v.....q.t.b.a.s.e._.p.l.....q.t.m.u.l.t.i.m.e.d.i.a._.p.l.....q.t.s.c.r.i.p.t._.p.l... .q.t.x.m.l.p.a.t.t.e.r.n.s._.p.l............,..

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\translations\qt_pt.qm

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):70334
                                                                                                                                                                                                                                                      Entropy (8bit):4.732724622610353
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:768:OKGUuWW+WHjS0gMBd483+Y7bDPs4RHBloLUIltlzAJnx4nnliM1OPlOibLG:JGUuWPuSgm0Jn+n4Mhj
                                                                                                                                                                                                                                                      MD5:6656500F7A28EF820AE9F97FD47FB5BB
                                                                                                                                                                                                                                                      SHA1:CC112B9C9513BCF7497F3417168B4C8A9F7640A9
                                                                                                                                                                                                                                                      SHA-256:2C1E7BBF5168A64B43752DD4C547601C0BDE6D610F8671FA3E3AF38597E84783
                                                                                                                                                                                                                                                      SHA-512:5C3CBFCF86AF6B4D949C1D914CD379E512E73BA350AF661033A386EE7FB981FBFCB43D9A35FDE7656E17BB09F64F1469F84867A780573C3359D645269461D5A6
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:<.d....!..`.......pt_PTB...(...*...9...+...e...]..6....;.......;..-....;..;`...;..};...;.......M..6....O... ...O...w...........}..7....m..7B..........+;......+;..8S..+;..>...+O......+O..8#..H4......H.......J......K.......LD...)..L....}..PS...l..Zr...B..[`...;..[`.....\...kU.._......._.......1...?...............8...............E............,..................p........0...............v...........%...O...%..G........4...0.......0..:....0..y....0..|....0.......0...X...5.......5...... D..=... D..Kn..+....L..,...>...,......<U..z...<U......<.......F...>...F.......H5...4..H5..=...H5..K...H5......f....p..f...1...f...;...f...I...f...|H..f.......f.......l....................b......<...............>.......L ...........`......`..._.......A......2....e...g...e..>D...e..LW................y...,.*.y.....*.y..o..*.y.....*.T..L..*.0..'..*.0....+F...y..+F......+f......+f...C..+.z..0..+.....d.+....p0.+.....R.+.z..0U.+.....u.+....8..+....Ct.+....L..+....y..+.....Z.+......+...pc.+.....+....0..

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\translations\qt_ru.qm

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):164
                                                                                                                                                                                                                                                      Entropy (8bit):3.984562388316898
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:3:j2wZC4C/oZlAlHekF8Op1MUNKJKlI+rwtbWlM4KKIPldkOSxRMugB:CwY+GIUgcIRt61oihM3
                                                                                                                                                                                                                                                      MD5:F7A8C75408B9A34A2B185E76F51B7B85
                                                                                                                                                                                                                                                      SHA1:065E987139C5FB809A6F9CDF3845BCD79707FDBB
                                                                                                                                                                                                                                                      SHA-256:6492B267608C6FB76907BD8FCFC8F1EF57E9F4EBBC2E81ACA81715A88388F94A
                                                                                                                                                                                                                                                      SHA-512:E768C5B438EC899801B22B1325F2244ACCC5E7C2EC5D270F510BC3CBC2D9A0536949C026DB7FB5862835E506A9F2020DEB2CC4001E7011FF974324542734F855
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:<.d....!..`.......ru....v.....q.t.b.a.s.e._.r.u.....q.t.s.c.r.i.p.t._.r.u.....q.t.m.u.l.t.i.m.e.d.i.a._.r.u... .q.t.x.m.l.p.a.t.t.e.r.n.s._.r.u........)......,..

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\translations\qt_sk.qm

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):157
                                                                                                                                                                                                                                                      Entropy (8bit):3.7731953311404336
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:3:j2wZC4C/3xRlAlHekE8lgp1MUM8lMlI+rwtbWlM5UllyIPldkOfll6kchn:CwS0+t8CIUM86IRt6KUlsoi2CVh
                                                                                                                                                                                                                                                      MD5:24C179481B5EF574F33E983A62A34D53
                                                                                                                                                                                                                                                      SHA1:0A67F1ED8CA4A5182F504806F8D47D499789F2D2
                                                                                                                                                                                                                                                      SHA-256:B6ADFFD889FF96BF195CB997327E7D7005A815CAD67823FA6915A19C2D9BB668
                                                                                                                                                                                                                                                      SHA-512:4757F3693120DAB2FBB7BCF1734EA20B3E3D9056B4B4E934A3129D660CFDC6C58B230459DB55912AF24AD5692BD221830BE0FF91E41D3EECD9439E79AC23FFE6
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:<.d....!..`.......sk....v.....q.t.b.a.s.e._.s.k.....q.t.s.c.r.i.p.t._.s.k.....q.t.m.u.l.t.i.m.e.d.i.a._.s.k... .q.t.x.m.l.p.a.t.t.e.r.n.s._.s.k...........

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\translations\qt_sl.qm

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):228428
                                                                                                                                                                                                                                                      Entropy (8bit):4.726953418955661
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:3072:9zQH0hOtgmiAZu0eeAEv+v49JnnSmICgr3n7jhCQUeinqyU5UggtRLGrQ2LZO+Y1:RpUsSpGr36wsR
                                                                                                                                                                                                                                                      MD5:D35A0FE35476BE8BD149CEE46E42B5E9
                                                                                                                                                                                                                                                      SHA1:9F3C85C115A283E5230D1EEAD84C8CB73A71FA03
                                                                                                                                                                                                                                                      SHA-256:C44E0313A9414CC0E490B65B0C036FA11BCA959353B228886547BC2C8492034F
                                                                                                                                                                                                                                                      SHA-512:BEEB1751882AF081E80BE93F7464D4C6322B724EFA2CBD3E1CBE709181D380C1C57E770FA962BB706D6FCF4A8CB393E3F6E187C1F604F8CEEFB201CA3200BD1C
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:<.d....!..`.......slB..<....*.......+.......@...C...A.......B...<...C.......D...2...E.......F...d...G.......H...W...I.......P.......Q.......R.......S...x...T.......U...n...V...%...W.......X.......Y.......]..g~...t...V.......f..................................;..G....;..[....;...q...;..ia...;... ...M..g....O.......O.......[..,e...........}..g....m..h........Q..(5......+;..2...+;...b..+;...i..+O..2...+O...4..1......E@......F.......H4......HY...%..H.......I.......I@......IA...9..IC......J...6...J.......J.......J...^...K...7...LD......L....n..PS...U..R.......T....=..Zr......[`...V..[`......\...!,..\...8U.._..."b.._.../h..1.......E...9......4...............5........e...................$...<...$..Z....[.......,.......y...L...y..].......H.......@.......J.......6........~..........E...O...E..+....E...~..............,1...%..8r...%...........^..............................5.......0..Gx...0.......0..P....0..h....0.......0.......5...^.......... D...... D......+....`..,.......,...-...<U

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\translations\qt_sv.qm

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):65851
                                                                                                                                                                                                                                                      Entropy (8bit):4.7906769989650515
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:1536:4u6DkpgyKmRmG15mGM6iFPi6Q/qTlOQZY2dKN8gKw:4u6DotUG1sGMZPi6Q/qTlO2Y2YKw
                                                                                                                                                                                                                                                      MD5:0E85E0E0E7DDFE3D4BDE302F27047F9C
                                                                                                                                                                                                                                                      SHA1:AE59348E0C2E4F86F99DA6CF5DAB3B7E92504B7C
                                                                                                                                                                                                                                                      SHA-256:4B4B6FF7FD237C9DA0301B4946132E68653D15EB5FAF38E4C5FBFEBB12DD97F7
                                                                                                                                                                                                                                                      SHA-512:8CAAB6C61E9FA26A3A289A9E4DC515D157B3092D6D4ED43861220261BD2B7CC79B35B52F9ADE4EF558B5385B37EAC14575420DD55C475F435BB95B6C1E2561B6
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:<.d....!..`...B.......*.......+...i...]..6....;.......;..-f...;..:;...;..t....;.......M..64...O.......O...........q...}..6\...m..6........(..+;......+;..7...+;..=...+O......+O..7c..H4......H.......J.......K....F..LD...+..L.......PS...N..Zr......[`...7..[`...N..\...h4.._....J.._....k..1...>...............7........}......D............,...........*......i....................................%.......%..Fc.......6...0.......0..9....0..q....0..t....0.......0.......5.......5...... D..<}.. D..I...+.......,...=X..,.......<U..r...<U...n..<.......F...=...F....F..H5......H5..<...H5..J4..H5......f.......f...1V..f...:f..f...H;..f...t&..f.......f.......l..................8......;z..............<.......Je.......6...`...&...`...!.......9......1....e.......e..=....e..J..............g...y.....*.y.../.*.y..h..*.y.....*.T..J..*.0..'[.*.0...K.+F...q..+F.....+f......+f...A..+.z../..+.......+....i`.+.....X.+.z../..+.....S.+....7..+....Bi.+....K..+....q..+.......+......+...i..+.....+....0..F0i.....G.

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\translations\qt_tr.qm

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):110
                                                                                                                                                                                                                                                      Entropy (8bit):3.630483009136986
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:3:j2wZC4C/7zl9lAlHekDN/01MULV4LlI+rwtbWlM+N:Cw5+wUGRIRt6n
                                                                                                                                                                                                                                                      MD5:16CDF5B9D48B0F795D532A0D07F5C3A0
                                                                                                                                                                                                                                                      SHA1:6E403C9096B3051973E2B681DFEBBC8DD024830D
                                                                                                                                                                                                                                                      SHA-256:F574A2CFD4715885C3DBDF5AE60995252673BD94FDAA9586F7E0586F6C1AC0EE
                                                                                                                                                                                                                                                      SHA-512:36A0431368010157EA8A45DCB00458076CCFFC08B37E443DEBD1AAD4A30C6080803337725A7A3DCBF2B410DC7BE89CEAF6C07C46F876E4EF5B08159E3BF38E6D
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:<.d....!..`.......tr....R.....q.t.b.a.s.e._.t.r.....q.t.s.c.r.i.p.t._.t.r.....q.t.m.u.l.t.i.m.e.d.i.a._.t.r

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\translations\qt_uk.qm

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):164
                                                                                                                                                                                                                                                      Entropy (8bit):4.021402900389864
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:3:j2wZC4C/ZlRlAlHekCczOp1MUKUt7KlI+rwtbWlM/cFKIPldkONRMugB:CwUl0+rjIUKUcIRt6M/oioM3
                                                                                                                                                                                                                                                      MD5:9B101363343847FE42167183320C03F0
                                                                                                                                                                                                                                                      SHA1:F0DF2CFF913E588B7CADFDABBF69F4F632B2F96A
                                                                                                                                                                                                                                                      SHA-256:F1621E680E1642F9463E4B07E7E78B50F9A7BDB7C321D7302039CB3405CBDEA4
                                                                                                                                                                                                                                                      SHA-512:DA14FDF8DB514902733CAAC492293873351C595EBBE0ACB0849BECE24AB822602EE64D01051F1426CD1FC13A95D8607302CF9B515D9806FDD3BD047087DE447C
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:<.d....!..`.......uk....v.....q.t.b.a.s.e._.u.k.....q.t.s.c.r.i.p.t._.u.k.....q.t.m.u.l.t.i.m.e.d.i.a._.u.k... .q.t.x.m.l.p.a.t.t.e.r.n.s._.u.k........)......,..

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\translations\qt_zh_CN.qm

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):117347
                                                                                                                                                                                                                                                      Entropy (8bit):5.8593733369029195
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:1536:51dXW89nqEFu54aekvRzHHSVuf8j2+/xc3lhnbsfdAoz/w:v9qEFeLekvRznSVHJG3lhn+djY
                                                                                                                                                                                                                                                      MD5:0D02F0DE5A12BCB338B7042DFBDAACF3
                                                                                                                                                                                                                                                      SHA1:B7C10D249D8986AD8C6939B370407D07227A39F5
                                                                                                                                                                                                                                                      SHA-256:28CDE75D7B32C81FEF1D4630C37B79A61DEC24B357632FF00D6365A57D8BE43B
                                                                                                                                                                                                                                                      SHA-512:21F02EBA36B4411921EA3C70310B8E454E8FC2B8F09957FD6A63B71689DC381F7A5E2C3BDF2810734D659AB43D8A7BD46EF6436ECC52F75C71B5F5C313365444
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:<.d....!..`.......zhB..+....*.......+.......@.......A...8...B.......C.......D.......E...V...F.......G...L...H.......I...9...P.......Q...e...R...^...S.......T...T...U.......V...|...W.......X...o...Y.......]..4 ...;...2...;..,....;..8....;.......;.......M..4H...O.......O...........#...}..4p...m..4........N..(5......+;...f..+;..6Y..+;..<...+O...8..+O..6'..1......E@......F....Y..H4..."..HY..J...H.......I.......J.......J.......K....5..LD..._..L......PS...V..Q....6..R...N...W..../..Zr.....[`.....[`......\...lU.._......._....L..1...<........j......6...............B........I...$..K....$.......,...g...y...3.......A......r...........................9..L7......;w...E..5b...E...G.......5...%.......%..D........`......*........................0.......0..8W...0..}y...0...6...0.......0.......5.......5...... D..:... D..J...+....R..,...;...,......<U..~...<U......<......F...;...F......H5...i..H5..:...H5..Jk..H5...w..VE...[..f....u..f...0X..f...9...f...E...f.......f.......f....j..g....A..l.

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\translations\qt_zh_TW.qm

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):141
                                                                                                                                                                                                                                                      Entropy (8bit):3.7198292994386235
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:3:j2wZC4C/0N6xg/Rl/gl+kNXDelHrwtbWlMwTolIPldkOfDn:CwOO2+g6Mt63oloiUn
                                                                                                                                                                                                                                                      MD5:ED4135D705AEF3D97F8BF6B8FF11F09C
                                                                                                                                                                                                                                                      SHA1:308E2B8F74B863A61AD0B68F4A18ED06965EBEAA
                                                                                                                                                                                                                                                      SHA-256:751ECDA0C33E061D91241268357FBD2F6B7F70A1116E714F28D22EFD61EC7A1A
                                                                                                                                                                                                                                                      SHA-512:B6E6D00553A9C427130129B9D30E862028E549F372A832F0F05747C8E2A79E443F4932EC3AE177537C8BA00D26B5B6CB97D5B35426AB5229F6A468CA485BE0B1
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:<.d....!..`.......zh_TW....n.....q.t.b.a.s.e._.z.h._.T.W...$.q.t.m.u.l.t.i.m.e.d.i.a._.z.h._.T.W...&.q.t.x.m.l.p.a.t.t.e.r.n.s._.z.h._.T.W

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\translations\qtbase_ar.qm

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):160017
                                                                                                                                                                                                                                                      Entropy (8bit):5.35627970915292
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:1536:XGlAMfkX1M0RdaCkR8lfv8vtc8EFrVYA2I4AJZWEWgHg1C8COvzHKHC6Jp9NV0V7:XUr0RACkIwDEpV1Lgf1ubtw3Bb
                                                                                                                                                                                                                                                      MD5:A7E4D0BA0FC5DF07F62CC66EC9878979
                                                                                                                                                                                                                                                      SHA1:21FD131B23BDD1BBA7BBB86F3ED5C83876F45638
                                                                                                                                                                                                                                                      SHA-256:E03FE68D83201543698FD7FE267DD5DFC5BFD195147E74FF2F19AC3491401263
                                                                                                                                                                                                                                                      SHA-512:D9E6B10506FCF20B5B783F011908083D9DF6C5DF88E21B10D07F53A01AD6506A4B921C85335A25BAE54E27BAD7D01B6E240D58FDEEAABC7FF32014EC120C2ECF
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:<.d....!..`.......arB..2....*.......+.......@.......A.......B..._...C......D.......E......F.......G... ...H...D...I...h...P...C...Q...g...R......S.......T.......U.......V...x...W......X.......Y.......]..'=...s......t...........]...........;..'....;..(....;.......;.......M..'e...O.......O...9...........}..'........C...=......m..'....t..........!o..(5...Z..+;..5u..+;..c...+O......1...!...D@...8..E@.....H4...,..HY..QI..H.......IC......J....1..J.......J.......LD......L.......PS......QR...R..R...V2..T.......U....]..X.......Zr.....[`......\....t..]x......_......._.......yg......1...6....E..8V..............C............................$..RN...[...0...,.......y.......y...................K...........9..R....E.."............z.......................%..F;...D...[..................................!....5.......0...I...0.......0...5...0..#....5.......5...p..............W}.. D..(... D..P=..+.......<U......<U......<.......H5..(...H5..P...L.......VE......VE......V....B..f...JJ..f.......f.

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\translations\qtbase_bg.qm

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):165337
                                                                                                                                                                                                                                                      Entropy (8bit):5.332219158085151
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:1536:9ULiyUxPoT6qx+J7FJlaaMJnxjqxq+0Uiff0mbVeb7wiEwYuYqDKBkKHMXHCIMll:9ULpIVFnpwUiEujw27ncUQUz
                                                                                                                                                                                                                                                      MD5:660413AD666A6B31A1ACF8F216781D6E
                                                                                                                                                                                                                                                      SHA1:654409CDF3F551555957D3DBCF8D6A0D8F03A6C5
                                                                                                                                                                                                                                                      SHA-256:E448AC9E3F16C29EB27AF3012EFE21052DAA78FABFB34CD6DFF2F69EE3BD3CDB
                                                                                                                                                                                                                                                      SHA-512:C6AE4B784C3D302D7EC6B9CE7B27DDAF00713ADF233F1246CD0475697A59C84D6A86BAA1005283B1F89FCC0835FD131E5CF07B3534B66A0A0AA6AC6356006B8F
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:<.d....!..`.......bg_BGB../....*..,....+..."...@...]...A.......B.......C.......D...P...E...!...F.......G.......H.......I.......P.......Q.......R...A...S...e...T.......U.......V.......W...1...X...U...Y...y...]..,....s...,...t...................P...;..+....;..-E...;..!....;..+....M..,Y...O...,...O...........*...}..,............=...Q...m..,....t...|......>...(5..1...+;..<...+;..o...+O...r..1...>...D@......E@......H4......HY..[...H.......IC......J....E..J....X..J.......LD......L....L..PS......QR.."...R...`...T....X..U.......X.......Zr...q..[`...`..\.......]x......_......._....T..yg.....1...=....E..?...............L(.......(...............'...$..\....[.......,...I...y...!...y...................S...........9..]%...E..5p...........z..!q...................%..O....D..................D.....8......:......?....5...&...0.......0.. ....0...c...0..5....5.......5..................b:.. D..-... D..Z...+.......<U......<U...0..<.......H5..-...H5..[...L.......VE..#a..VE..;...V.......f...T...f...!..

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\translations\qtbase_ca.qm

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):210159
                                                                                                                                                                                                                                                      Entropy (8bit):4.666388181115542
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:3072:P/DVhdlafzvZfeW+6kXEVjSVPzC3ceKdP2:xYf7UW+WjwP2
                                                                                                                                                                                                                                                      MD5:B383F6D4B9EEA51C065E73ECB95BBD23
                                                                                                                                                                                                                                                      SHA1:DD6C2C4B4888B0D14CEBFC86F471D0FC9B07FE42
                                                                                                                                                                                                                                                      SHA-256:52E94FCC9490889B55812C5433D009B44BDC2DC3170EB55B1AF444EF4AAE1D7F
                                                                                                                                                                                                                                                      SHA-512:9401940A170E22CE6515E3C1453C563D93869A3C3686C859491A1F8795520B61BF3F0BFE4687A7380C0CC0C75E25559354FDB5CEF916AF4C5B6CD9661464A54A
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:<.d....!..`.......caB..7....*.......+.../...@..:P...A..:t...B..:....C..:....D..;=...E..<....F..<Z...G..<~...H..<....I..<....P..>....Q..>....R..?....S..?R...T..?v...U..?....V..?....W..@....X..@<...Y..@`...]../....s..1....t..........2s......#p...;.......;../....;..W....;..e+...M../3...O.......O..9.......J....}../]......8....=..9....m../....t..9Y.......S..(5..lB..+;.._...+;...=..+O..U...1.......D@..:...E@..?...H4...J..HY..~...H..."...IC...0..J....W..J....0..J.......LD..!...L...!f..PS..)...QR.."...R.......T...9~..U...9...U...z...X...>...Zr..E...[`...e..\...LD..]x..7U.._......._...M...yg..f...1...a....E..c....7.........U.......p........b.......4.......K...$.......[.......,.......y.......y...................^...........9...:...E...s...... (...z..":.......d......!....%..tQ...D.."......."......2......ve.....y...........5..#H...0...\...0..W+...0..';...0.......5..(....5..........)s.......... D..0w.. D..}...+...1...<?..5x..<U......<U..5...<...6@..H5..0...H5..~...L...9...VE..$...V...SV..f.

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\translations\qtbase_cs.qm

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):174701
                                                                                                                                                                                                                                                      Entropy (8bit):4.87192387061682
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:3072:5WjuhX0CVRaakGjW9E8SSOQfX/JlwVOMxrboRPqWxXfQvO7zjBf:5iFGj1QfXr8Gd
                                                                                                                                                                                                                                                      MD5:C57D0DE9D8458A5BEB2114E47B0FDE47
                                                                                                                                                                                                                                                      SHA1:3A0E777539C51BB65EE76B8E1D8DCE4386CBC886
                                                                                                                                                                                                                                                      SHA-256:03028B42DF5479270371E4C3BDC7DF2F56CBBE6DDA956A2864AC6F6415861FE8
                                                                                                                                                                                                                                                      SHA-512:F7970C132064407752C3D42705376FE04FACAFD2CFE1021E615182555F7BA82E7970EDF5D14359F9D5CA69D4D570AA9DDC46D48CE787CFF13D305341A3E4AF79
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:<.d....!..`.......cs_CZB..3p...*..F....+.......@..!....@..Ef...A..!....A..E....B.."1...B..E....C.."U...C..E....D.."....D..F....E..#p...E..F)...F..#....F..FP...G..#....G..Fw...H..$....H..F....I..$6...I..F....P..&%...P..Gr...Q..&I...Q..G....R..&....R..G....S..&....S..H....T..&....T..H8...U..'....U..H_...V..'Z...V..H....W..'~...W..H....X..'....X..H....Y..'....Y..H....]..,....]..,....s.......t...9...............*...;.......;..+....;..1B...;......;..?x...;..N....;..iY...;..s3...M..,B...M..,....O.......O...w...O..rr...........}..,j...}..-....... 5...=.. ....m..,....m..-8...t.. .......ay..(5..TT..+;...A..+;..B...+;..u...+O......+O..=a..1...a...D@.."...E@..&m..E@..G...F...J...H4...=..HY..`...H.......I...J...IC......J....-..J.......J.......LD......L....(..PS.....QR.."S..R...e...T.... ..U......X.......Zr...g..[`......\......]x......_......._......._...v...yg......1...C....E..E...............=.......Q........................s...$..a....[.......,.......y.......y...y..............G..........

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\translations\qtbase_da.qm

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):181387
                                                                                                                                                                                                                                                      Entropy (8bit):4.755193800761075
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:3072:XzswP2UvZ5aZ9jFTkmq/gnBNW/+PcWrqm2Vliz0DGdaS4KSLZjwTTgwUR0toT:j3m27AjCT
                                                                                                                                                                                                                                                      MD5:859CE522A233AF31ED8D32822DA7755B
                                                                                                                                                                                                                                                      SHA1:70B19B2A6914DA7D629F577F8987553713CD5D3F
                                                                                                                                                                                                                                                      SHA-256:7D1E5CA3310B54D104C19BF2ABD402B38E584E87039A70E153C4A9AF74B25C22
                                                                                                                                                                                                                                                      SHA-512:F9FAA5A19C2FD99CCD03151B7BE5DDA613E9C69678C028CDF678ADB176C23C7DE9EB846CF915BC3CC67ABD5D62D9CD483A5F47A57D5E6BB2F2053563D62E1EF5
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:<.d....!..`.......daB..4....*..h....+......@...f...A.......B.......C.......D...U...E.......F...v...G.......H.......I.......P.......Q.......R...6...S...Z...T...~...U.......V.......W..."...X...F...Y...j...]..+....s.......t..................-...;..+....;..,....;../....;..;....M..+....O.......O...r...........}..,............=...8...m..,0...t...c......T...(5..B...+;..NH..+;..~H..+O..,...1...UP..D@......E@......H4...E..HY..j...H.......IC...#..J....J..J.......J.......LD......L....1..PS...B..QR......R...o...T.......U.......X.......Zr......[`...W..\....}..]x...[.._....-.._.......yg...e..1...O....E..R....7..........-!......]............................$..k....[...7...,.......y...c...y.................j4...........9..l8...E..p............z...;..................%..a....D...~.............-.....L......OH.....Uz...5.......0.......0...U...0.......0..p....5...7...5..L$..............p... D..-... D..i...+....@..<U.....<U.....<....S..H5..-2..H5..j$..L....B..VE.. ...VE..P...V...*...f...e...f.

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\translations\qtbase_de.qm

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):220467
                                                                                                                                                                                                                                                      Entropy (8bit):4.626295310482312
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:3072:7w8go8+ph6JVB8XVXYWpSNEeg8+vaD+p4N8DDiEKugwGZulh15ce4M+4NsPYXCZW:88h8Sj286tTiDD
                                                                                                                                                                                                                                                      MD5:40760A3456C9C8ABE6EA90336AF5DA01
                                                                                                                                                                                                                                                      SHA1:B249AA1CBF8C2636CE57EB4932D53492E4CE36AC
                                                                                                                                                                                                                                                      SHA-256:553C046835DB9ADEF15954FA9A576625366BA8BFD16637038C4BCD28E5EBACE1
                                                                                                                                                                                                                                                      SHA-512:068E55F39B5250CC937E4B2BD627873132D201D351B9351BE703CD9B95D3BAFB4BD649CB4DF120A976D7C156DA679758D952CAC5E0523107244E517D323BC0C5
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:<.d....!..`.......de_DEB..7....*.......+..3....@..R....A..R....B..S....C..S@...D..S....E..T]...F..T....G..T....H..T....I..U#...P..W....Q..W6...R..W....S..W....T..W....U..W....V..XG...W..Xk...X..X....Y..X....]..2%...s..J$...t..9R......J.......B....;..1....;..3....;..q....;.......M..2O...O.......O..X@......ia...}..2y......Q....=..Q....m..2....t..Q...........(5......+;..ev..+;......+O..oh..1....4..D@..R...E@..WZ..H4..4...HY...[..H...AY..IC..>o..J...>...J.......J...>6..LD..@A..L...@...PS..I...QR..#...R....h..T...W...U...Xh..U....~..X...]...Zr..e(..[`..)...\...j...]x..O..._....K.._...lI..yg...U..1...f....E..i....7..........o.......wG......6.......6.......8....$...n...[..8....,..9....y.......y..=................3......>....9.......E..."......?_...z..#d.......0......A%...%..z....D..A.......B......KP......2.............^...5..B....0.......0..p....0..F....0...}...5..G....5..........H........... D..3}.. D...O..+...Q...<?..Ti..<U......<U..T...<...U)..H5..3...H5......L...X...VE..%j..V...l..

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\translations\qtbase_en.qm

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):16
                                                                                                                                                                                                                                                      Entropy (8bit):4.0
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:3:j2wZC4n:CwZ
                                                                                                                                                                                                                                                      MD5:BCEBCF42735C6849BDECBB77451021DD
                                                                                                                                                                                                                                                      SHA1:4884FD9AF6890647B7AF1AEFA57F38CCA49AD899
                                                                                                                                                                                                                                                      SHA-256:9959B510B15D18937848AD13007E30459D2E993C67E564BADBFC18F935695C85
                                                                                                                                                                                                                                                      SHA-512:F951B511FFB1A6B94B1BCAE9DF26B41B2FF829560583D7C83E70279D1B5304BDE299B3679D863CAD6BB79D0BEDA524FC195B7F054ECF11D2090037526B451B78
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:<.d....!..`...

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\translations\qtbase_es.qm

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):165170
                                                                                                                                                                                                                                                      Entropy (8bit):4.679910767547088
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:1536:JVwzuvb+Ta64KQd84arHX5pxiVhA8QlOD/BnFNa8NsvsfFsfcoZtIx6F:JVwSTG4KqVaLX5pEVK7OJFczstgRtIx8
                                                                                                                                                                                                                                                      MD5:C7C58A6D683797BFDD3EF676A37E2A40
                                                                                                                                                                                                                                                      SHA1:809E580CDBF2FFDA10C77F8BE9BAC081978C102B
                                                                                                                                                                                                                                                      SHA-256:4FFDA56BA3BB5414AB0482D1DDE64A6F226E3488F6B7F3F11A150E01F53FA4C8
                                                                                                                                                                                                                                                      SHA-512:C5AED1A1AA13B8E794C83739B7FDDEAFD96785655C287993469F39607C8B9B0D2D8D222ECD1C13CF8445E623B195192F64DE373A8FB6FE43743BAF50E153CDA5
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:<.d....!..`.......es_ESB../....*..*,...+...y...@.......A.......B.......C.......D...v...E...=...F.......G.......H.......I.......P.......Q... ...R...k...S.......T.......U.......V...1...W...U...X...y...Y.......]..+....s.......t...................c...;..+....;..,....;...%...;..#....;..-....M..+....O.......O...............}..,............=...]...m..,/...t..........A...(5..3...+;..<...+;..o...+O..!b..1...Ap..D@......E@...D..H4...-..HY..[F..H.......IC...%..J....L..J.......J.......LD......L....O..PS......QR..!...R...`K..T.......U....&..X.......Zr.....[`...h..\......]x...|.._....Y.._....A..yg......1...=....E..?a......!.......K........G...............R...$..\Q...[.......,...z...y.......y..................+............9..\....E..2............z.. ....................%..ON...D........................:......=B.....A....5...7...0.......0......0.."....0...,...0..3....5...}...5...Y..............a... D..-!.. D..Z6..+....0..<U...h..<U......<.......H5..-M..H5..Z...L.......VE.."...VE..>...V......

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\translations\qtbase_fi.qm

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):179941
                                                                                                                                                                                                                                                      Entropy (8bit):4.720938209922096
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:3072:lvdTgO2Yl97ZWnbgTLt/Tf9IlqAeiy5uWkYGM0wNCdRjSK2YUlUs:lvdkA9vh5uWkY0MK2YXs
                                                                                                                                                                                                                                                      MD5:8472CF0BF6C659177AD45AA9E3A3247C
                                                                                                                                                                                                                                                      SHA1:7B5313CDA126BB7863001499FB66FB1B56C255FC
                                                                                                                                                                                                                                                      SHA-256:E47FE13713E184D07FA4495DDE0C589B0E8F562E91574A3558A9363443A4FA72
                                                                                                                                                                                                                                                      SHA-512:DE36A1F033BD7A4D6475681EDC93CC7B0B5DCB6A7051831F2EE6F397C971B843E1C10B66C4FB2EFF2A23DC07433E80FBF7B95E62C5B93E121AB5AD88354D9CB8
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:<.d....!..`.......fiB..38...*..ct...+......@.......A.......B.......C...@...D.......E...]...F.......G.......H.......I...#...P.......Q...6...R.......S.......T.......U.......V...G...W...k...X.......Y.......]..*....s...T...t.......................;..*....;..+....;..&....;..3....M..+!...O.......O...e...........}..+K...........=.......m..+w...t..........J...(5..9...+;..:y..+;..mW..+O..$...1...KY..D@......E@...Z..H4...l..HY..X&..H.......IC......J.......J...."..J......LD.....L.......PS...'..QR.. L..R...]...T.......U.......X.......Zr......[`......\.......]x......_....k.._....>..yg.. /..1...;....E..>....7..{(......%.......J........T.......&.......U...$..Y[...[......,...s...y.......y...a.......}......d...........9..Y....E..k'...........z...........V..........%..M....D...Q.......{......d.....A......E......K....5.......0.......0..&J...0.......0..k....5...*...5..I9.............._:.. D..,O.. D..W...+....9..<U...G..<U...*..<.......H5..,y..H5..W...H5......L....5..VE..!u..VE..E...V..."{..f.

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\translations\qtbase_fr.qm

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):166167
                                                                                                                                                                                                                                                      Entropy (8bit):4.685212271435657
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:1536:CLZ1w8McowCppcPwL5pYFw+G00QsbLckCiWxvq+sjs06oFm:C91wxcowspc4L5pUw+cz39CiQ7tloFm
                                                                                                                                                                                                                                                      MD5:1F41FF5D3A781908A481C07B35998729
                                                                                                                                                                                                                                                      SHA1:ECF3B3156FFE14569ECDF805CF3BE12F29681261
                                                                                                                                                                                                                                                      SHA-256:EDB32A933CEF376A2636634E14E2977CED6284E4AA9A4AC7E2292F9CA54C384A
                                                                                                                                                                                                                                                      SHA-512:A492E8AC88095A38A13549C18C68E1F61C7054AB9362C2B04C65B93E48E4A07941C8DA6950BAE79041094623E0ED330CA975110FDE8248B4D9380B9F729AD891
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:<.d....!..`.......fr_FRB../....*..-....+.......@.......A.......B.......C...?...D.......E...\...F.......G.......H.......I..."...P.......Q...5...R.......S.......T.......U.......V...F...W...j...X.......Y.......]..+....s...=...t.......................;..+....;..,....;.......;..$b...;.......M..,....O.......O...5...........}..,3...........=.......m..,]...t..........A...(5..5j..+;..<T..+;..o...+O.."+..1...B\..D@......E@...Y..H4...8..HY..[{..H.......IC......J.......J.......J.......LD...|..L.......PS...?..QR..!...R...`j..T.......U....[..X.......Zr.....[`...)..\......]x......_....7.._.......yg...i..1...=Q...E..?@......"Y......K............................$..\....[...^...,...'...y.......y...+.......o....../c.......Y...9..\....E..6(...........z..!................j...%..OC...D...+.......[......a.....;......>......B....5.......0.......0...m...0..#....0.......0..6....5.......5..................a... D..-Y.. D..Ze..+....]..<U...;..<U......<.......H5..-...H5..Z...L.......VE.."...VE..?...V......

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\translations\qtbase_gd.qm

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):189580
                                                                                                                                                                                                                                                      Entropy (8bit):4.630160941635514
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:1536:SiaI3C87jhakhR0VGkw7ys7CskUH6y4e6IFB4xyMuhvDnJGhFaCo527arBbm07LZ:S2yGjh17yGqxTXhvQoejJd8FUjVgk
                                                                                                                                                                                                                                                      MD5:EB1FB93B0BE51C2AD78FC7BA2F8B9F42
                                                                                                                                                                                                                                                      SHA1:24F7FF809E2F11C579CD388FEA5A4C552FF8D4D0
                                                                                                                                                                                                                                                      SHA-256:63B439DD44139AA3AED54C2EBE03FA9BC77F22C14ED8FBA8EFF2608445BB233D
                                                                                                                                                                                                                                                      SHA-512:E13770AEF33B6666ED7D54E03EE20CA291D4167D673BA6C61D8E64CDD5F7FFE0A9521B95AF67BE719BF263932ECF16E2B2D0B5F3404F9BCD7879114FCC6FC474
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:<.d....!..`.......gd_GBB..2....*...u...+......@.......A...B...B.......C.......D.. ....E.. ....F..!&...G..!J...H..!n...I..!....P..#m...Q..#....R..#....S..$....T..$$...U..$H...V..$....W..$....X..$....Y..%....]../....s...'...t...................F...;.......;../....;..=V...;..G....M../G...O.......O...k......$....}../o.......i...=.......m../....t..........[...(5..M...+;..@...+;..x...+O..:...1...\7..D@...f..E@..#...H4...p..HY..be..H.......IC......J.......J....R..J.......LD......L.......PS......QR..#l..R...g...T.......U.......X....\..Zr......[`......\...&...]x......_....C.._...'t..yg..?...1...BM...E..D.......;.......R'.......t.......@.......?...$..c....[......,...i...y.......y...Y.......f.......+...........9..c....E...............z.."....................%..U....D..................G.....UB.....W......\]...5.......0.......0..<....0...;...0.......5.......5..ij..............h... D..0... D..aC..+....K..<U.....<U...~..<.......H5..0...H5..a...L....1..VE..$...VE..X...V...8|..f...Z...f...=..

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\translations\qtbase_he.qm

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):138690
                                                                                                                                                                                                                                                      Entropy (8bit):5.515748942553918
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:3072:XSue8Z7T3iJsqBejt/zNHSLzdetY2ZISfC/S:XSueK3w7Ijt8zUtYAISfC/S
                                                                                                                                                                                                                                                      MD5:DEAF87D45EE87794AB2DC821F250A87A
                                                                                                                                                                                                                                                      SHA1:DB39C6BAA443AA9BB208043EF7FB7E3403C12D90
                                                                                                                                                                                                                                                      SHA-256:E1EBCA16AFE8994356F81CA007FBDB9DDF865842010FE908923D873B687CAD3F
                                                                                                                                                                                                                                                      SHA-512:276FCE81249EFFE19E95607C39F9ACB3A4AFA3F90745DA21B737A03FEA956B079BCA958039978223FD03F75AC270EC16E46095D0C6DDA327366C948EC2D05B9C
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:<.d....!..`.......he_ILB../....*......+..Sw...@......A......B.......C.......D...X...E.......F.../...G...O...H...o...I......P.......Q.......R...I...S...i...T......U......V.......W.......X.../...Y...O...]..$....s......t..X:.......4......`Y...;..$....;..%....;.......;...5...;.......M..$....O...6...O..s............}..%-...........=...m...m..%k...t..........^..(5......+;..2...+;..^...+O...N..1.......D@......E@...(..H4..T...HY..L...H..._...IC..\...J...\...J.......J...\j..LD..^...L...^o..PS..fl..QR......R...Q...T...su..U...s...X...x3..Zr..~...[`..L\..\.......]x....._......._....o..yg...(..1...3....E..5C.......z......?V......U.......U.......W....$..M....[..W....,..X....y.......y..\........a..............\@...9..NO...E...?......]s...z...G.......(......^....%..B^...D.._......._.................... ..........5..`/...0.......0...L...0......0..d(...0......5..ek...5..........fB......R... D..&O.. D..K...+...l...<U......<U..p)..<...p...H5..&w..H5..La..L...s...VE......VE......V.....

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\translations\qtbase_hu.qm

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):160494
                                                                                                                                                                                                                                                      Entropy (8bit):4.831791320613137
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:3072:BmOMZadV9n51xXeQvjOiIzz7/Vs9Db3ihuJNvMfWxBNlYzYbTrIkfwb03l24cNKu:HkWa5pg0MahBHDd
                                                                                                                                                                                                                                                      MD5:E9D302A698B9272BDA41D6DE1D8313FB
                                                                                                                                                                                                                                                      SHA1:BBF35C04177CF290B43F7D2533BE44A15D929D02
                                                                                                                                                                                                                                                      SHA-256:C61B67BB9D1E84F0AB0792B6518FE055414A68E44D0C7BC7C862773800FA8299
                                                                                                                                                                                                                                                      SHA-512:12947B306874CF93ABA64BB46FAC48179C2D055E770D41AF32E50FFFB9F0C092F583AFCEA8B53FE9E238EF9370E9FFFBEB581270DFA1A7CB74EBE54D9BFF459F
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:<.d....!..`.......hu_HUB../....*.......+.......@.......A...0...B...{...C.......D.......E.......F.......G...<...H...`...I.......P...s...Q.......R.......S.......T...*...U...N...V.......W.......X.......Y.......]..+y...s.......t.......................;..+Q...;..,U...;.......;.......;..&....M..+....O.......O...U..........}..+............=.......m..+....t..........9c..(5..,...+;..;...+;..m7..+O......1...9...D@...T..E@......H4...v..HY..Y...H.......IC......J.......J.......J.......LD......L.......PS...}..QR..!...R...]...T.......U....{..X.......Zr...=..[`......\....*..]x...-.._......._......yg...M..1...<....E..>...............J........T.......(.......S...$..Z....[.......,...u...y.......y...[...............#...........9..Z....E..#&...........z..!'...................%..Mv...D..._....................32.....5......9....5.......0...h...0...E...0.......0.......0..#....5...Z...5...........G......_2.. D..,... D..W...+....W..<U......<U...B..<.......H5..,...H5..X{..L....)..VE.."...VE..6l..V....*.

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\translations\qtbase_it.qm

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):161172
                                                                                                                                                                                                                                                      Entropy (8bit):4.680034416311688
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:1536:eSfxfdO4BKJb0td5pqCOIUP/PFIM7gxGQ9sRrFM6QJ4m8ihkM:eSfxFO4BKJb0td5pnOrvCqg9mRK4IkM
                                                                                                                                                                                                                                                      MD5:88D040696DE3D068F91E0BF000A9EC3E
                                                                                                                                                                                                                                                      SHA1:F978B265E50D14FDDE9693EC96E99B636997B74D
                                                                                                                                                                                                                                                      SHA-256:7C7DC8B45BF4E41FEC60021AB13D9C7655BE007B8123DB8D7537A119EB64A366
                                                                                                                                                                                                                                                      SHA-512:F042637B61C49C91043D73B113545C383BD8D9766FD4ACC21675B4FF727652D50863E72EA811553CB26DF689F692530184A6CE8FE71F9250B5A55662AFE7D923
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:<.d....!..`.......it_ITB../....*.......+.......@.......A..."...B...m...C.......D.......E.......F.......G...0...H...T...I...x...P...q...Q.......R.......S.......T...(...U...L...V.......W.......X.......Y.......]..+....s...'...t...................^...;..+[...;..,g...;.......;.......;..!B...M..+....O...D...O...........(...}..+........I...=.......m..,....t..........4...(5..'...+;..<...+;..oV..+O......1...5...D@...F..E@......H4...J..HY..Z...H.......IC...L..J....s..J....j..J.......LD......L....f..PS......QR..!...R..._...T.......U....3..X.......Zr......[`...Q..\.......]x......_......._....0..yg...C..1...=....E..?o..............Kf.......h.......8.......I...$..[....[.......,...m...y...9...y...........z.......z...........9..\=...E..$u.......:...z.. k...................%..N....D..................M............0......5/...5...2...0.......0...0...0...A...0...)...0..$....5.......5...J.......a......a... D..,... D..Y...+.......<U......<U......<....v..H5..-...H5..Z...L.......VE.."c..VE..1...V....X.

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\translations\qtbase_ja.qm

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):129911
                                                                                                                                                                                                                                                      Entropy (8bit):5.802855391832282
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:1536:W8YYSCjKBJ26c1Z7f25pVmuLXpxfqt7FEUWNrfQje9kWI23pKXvx:xYuKBJ01Z7u5pQuLbESUWNzAAI23pKfx
                                                                                                                                                                                                                                                      MD5:608B80932119D86503CDDCB1CA7F98BA
                                                                                                                                                                                                                                                      SHA1:7F440399ABA23120F40F6F4FCAE966D621A1CC67
                                                                                                                                                                                                                                                      SHA-256:CBA382ACC44D3680D400F2C625DE93D0C4BD72A90102769EDFD1FE91CB9B617B
                                                                                                                                                                                                                                                      SHA-512:424618011A7C06748AADFC2295109D2D916289C81B01C669DA4991499B207B781604A03259C546739A3A6CF2F8F6DFA753B23406B2E2812F5407AEE343B5CBDD
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:<.d....!..`.......jaB../....*...'...+..=....@.......A.......B...?...C...c...D......E......F.......G.......H..."...I...F...P.......Q...'...R...r...S......T......U.......V...8...W...\...X......Y......].."k...s...Q...t..A...............I....;.."C...;..#A...;.......;.......;.......M.."....O...B...O..[?......h....}.."........m...=.......m.."....t...........M..(5......+;......+;..WU..+O......1.......D@......E@...K..H4..>=..HY..F...H...Hr..IC..E...J...F...J.......J...E...LD..Gz..L...G...PS..O...QR......R...K!..T...Z...U...[e..X..._f..Zr..e...[`..7...\...i...]x...'.._......._...j...yg..~+..1.../....E..1?.......#......:.......?.......?n......A....$..G....[..Ap...,..B....y.......y..Ew......|...............E....9..H....E..........F....z...]..............HL...%..=R...D..H.......I!......[......J......M..........5..It...0...3...0.......0...C...0..M....0...a...5..N....5..........N.......L6.. D..#... D..E...+...U%..<U......<U..X ..<...X...H5..#...H5..FK..L...[...VE......VE......V......f.

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\translations\qtbase_ko.qm

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):156799
                                                                                                                                                                                                                                                      Entropy (8bit):5.859529082176036
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:1536:rvTy18hhPekHs1iNXVExWbStnn8TExgkYOvYejZOvXx4Mmf0MwUL8smk/pDZyy:y18hJ61nMStnn8TOgknQRLWZmkxNyy
                                                                                                                                                                                                                                                      MD5:082E361CBAC2E3A0849F87B76EF6E121
                                                                                                                                                                                                                                                      SHA1:F10E882762DCD2E60041BDD6CC57598FC3DF4343
                                                                                                                                                                                                                                                      SHA-256:0179ED1B136E1CB3F583351EAA2C545BA3D83A6EE3F82C32505926A1A5F5F183
                                                                                                                                                                                                                                                      SHA-512:F378A42116924E30FA0B8FFF1D3C3CB185DC35B2746DCE2818BE7C2AA95C5DE103DF44AAC74DA969C36C557F1D4DE42AC7647EC41066247F8AD2697BDED667EA
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:<.d....!..`.......koB..7....*.......+.......@...K...A...o...B......C.......D...8...E.......F...U...G...y...H......I.......P......Q.......R.......S...C...T...g...U.......V.......W.......X...-...Y...Q...]..$....s...>...t...................y...;..${...;..%....;...u...;...l...M..$....O.......O...8...........}..$............=...C...m..%!...t...n..........(5...a..+;..E@..+;..l|..+O......1.......D@.....E@......H4......HY..\...H....]..IC......J.......J....8..J.......LD...a..L.......PS......QR......R...`...T.......U....^..U.......X....y..Zr......[`..y...\....A..]x......_......._....o..yg......1...FJ...E..HE...7..................Q........a.......5...........$..]....[...;...,.......y.......y...V...............!.......|...9..]....E...R...........z...4.......f.......5...%..Te...D..................D......^.............*...5...S...0.......0.......0.......0.......5.......5...........n......a... D..%... D..[...+.......<?......<U...;..<U...+..<.......H5..&...H5..\...L.......VE......V....A..f.

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\translations\qtbase_lv.qm

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):153608
                                                                                                                                                                                                                                                      Entropy (8bit):4.843805801051326
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:3072:y5pmbKIhooMbGe91MrjOhmGzP6LJbWz5XIxELpU6:yObeqrjPGzeJyJLy6
                                                                                                                                                                                                                                                      MD5:BD8BDC7BBDB7A80C56DCB61B1108961D
                                                                                                                                                                                                                                                      SHA1:9538C4D8BB9A95C0D9DC57C7708A99DD53A32D1F
                                                                                                                                                                                                                                                      SHA-256:846E047573AE40C83671C3BA7F73E27EFC24B98C82701DA0DF9973E574178BB2
                                                                                                                                                                                                                                                      SHA-512:F040EC410EBFEA21145F944E71ADCAE8E5F60907D1D3716A937A9A59A48F70C6B7EAAC91C2C554F59357A7BC820CDBD17C73A4DECC20B51F68EB79EDD35C5554
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:<.d....!..`.......lv_LVB.......*...B...+..y....@.......A...=...B......C......D.......E.......F...#...G...G...H...k...I.......P...~...Q......R.......S.......T...5...U...Y...V......W.......X.......Y.......]..%....s.......t...8.......n.......A...;..&....;.......;...!...;...A...;../....M..%....O.......O...............}..%...........=.......m..&....t...(......(g..(5...+..+;..4...+;..d...+O......1...(...D@...a..E@......H4..z...HY..Q...H.......IC......J....6..J.......J.......LD......L....9..PS......QR......R...U...T....S..U.......X...._..Zr......[`..r...\.......]x...*.._......._....{..yg......1...5v...E..7........(......B.......|.......|W......~r...$..R....[..~....,.......y...l...y...............................9..S....E...g...........z...z...................%..F....D........................"Z.....$......)....5.......0...\...0.......0...r...0.......0.......5...a...5..........J......V... D..&... D..P...+.......<U......<U......<.......H5..'"..H5..P...L....~..VE...R..VE..%...V......

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\translations\qtbase_pl.qm

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):162982
                                                                                                                                                                                                                                                      Entropy (8bit):4.841899887077422
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:1536:sXpestp/YIFtDT8FIWYbIJmPYuIpnmxAk6mwyJNqSm9+P:sxpTDT8FIWfJmdCmxApmbnqSm9+P
                                                                                                                                                                                                                                                      MD5:F9475A909A0BAF4B6B7A1937D58293C3
                                                                                                                                                                                                                                                      SHA1:76B97225A11DD1F77CAC6EF144812F91BD8734BD
                                                                                                                                                                                                                                                      SHA-256:CE99032A3B0BF8ABAD758895CC22837088EAD99FD2D2514E2D180693081CFE57
                                                                                                                                                                                                                                                      SHA-512:8A4F1B802B6B81FF25C44251FB4A880E93E9A5FE25E36825A24BFE0EFB34E764E7E1EE585D3A56554964B7921E7813C67F12D200D6E0C5EAF4BB76B064B5C890
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:<.d....!..`.......pl_PLB..0....*.."....+.......@...F...A...j...B......C.......D...3...E.......F...P...G...t...H.......I.......P.......Q.......R.......S...>...T...b...U.......V.......W.......X...(...Y...L...]..*....s.......t...r.......o.......+...;..*....;..+....;..."...;... ...M..*....O...6...O...........a...}..+...........=.......m..+G...t...G......,...(5......+;..:...+;..k...+O......1...-[..D@.....E@......H4...U..HY..WU..H.......IC......J....6..J.......J.......LD......L....%..PS......QR.. ...R...[...T....1..U.......X......Zr......[`......\.......]x...A.._......._....}..yg......1...;W...E..=........%......H....................$..Xp...[.......,.......y...i...y...........}......$R...........9..X....E..+)...........z.. E...................%..K....D...p....................&......(......-....5.......0.......0...e...0.......0..+....5...]...5...........f......]-.. D..,%.. D..V?..+....V..<U......<U......<....-..H5..,M..H5..V...L....Z..VE..!...VE..)...V.......f...P...f....K..f......

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\translations\qtbase_ru.qm

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):203767
                                                                                                                                                                                                                                                      Entropy (8bit):5.362551648909705
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:1536:hn4dEJ63pdhPpy6gu5fs4MHQv6sLlxnrncF423ZL9xyuXwdcX8LZuf76CW+WeXFx:aN3pdV5fZbpItXsttRY+WSq
                                                                                                                                                                                                                                                      MD5:5096AD2743BF89A334FBA6A2964300D4
                                                                                                                                                                                                                                                      SHA1:405F45361A537C7923C240D51B0FF1C46621C203
                                                                                                                                                                                                                                                      SHA-256:3DA6605668F9178D11A838C4515478084DCFB4F9CF22F99D7A92B492DB9C224B
                                                                                                                                                                                                                                                      SHA-512:7B88B501792B5831426BAA669138192ED94CC3F8323A3DF9D5287655DC4D877706908C517AB7523AE8A283BF50B47123F13B8AE40EA2F3081C3459EDC47FC8DD
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:<.d....!..`.......ru_RUB..7....*...L...+...W...@..,....A..,....B..-1...C..-U...D..-....E...r...F.......G.......H../....I../8...P..1'...Q..1K...R..1....S..1....T..1....U..2....V..2\...W..2....X..2....Y..2....].......s..$c...t...'......%........r...;..-....;.......;..J....;..V....M...C...O.......O..&.......8....}...m......+3...=..+....m.......t..+.......p...(5..]@..+;..[0..+;......+O..H...1...qM..D@..-...E@..1o..H4...p..HY..xm..H....*..IC...@..J....g..J.......J.......LD......L....p..PS......QR..!...R...}...T...&...U...'...U...ki..X...+...Zr..3...[`......\...:...]x..)..._......._...;...yg..S...1...\....E..__...7.........H.......k................j.......U...$..y....[.......,.......y...k...y...............................9..y....E...O...........z..!*...................%..nW...D.................%w.....g......j~.....qw...5...H...0.......0..I....0..._...0......5.......5..................~... D../k.. D..wa..+....?..<?.."t..<U......<U.."...<...#z..H5../...H5..w...L...&...VE.."...V...F$.

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\translations\qtbase_sk.qm

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):125763
                                                                                                                                                                                                                                                      Entropy (8bit):4.80343609423322
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:3072:roXDuC1u/2lUBGjJirE5tsd/aev1GIfOdvhw:OucMGjH5tbm
                                                                                                                                                                                                                                                      MD5:3D60E50DCBCBD70EE699BC9B1524FCB9
                                                                                                                                                                                                                                                      SHA1:0211B4911B5B74CC1A46C0FCA87D3BF5632AA44A
                                                                                                                                                                                                                                                      SHA-256:D586AE2C314074CF398417FDECB40709D5478DFEB0A67C2FE60D509EE9B59ED7
                                                                                                                                                                                                                                                      SHA-512:F98211867F1DBCB8A342C00E23FA5718BE6E999F7449CB8470B41BF0F527C7F78CC4D6666E28968F32E96026907156753979BFADA7E6BF4225D02A902D24906D
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:<.d....!..`.......sk_SKB..$x...*.......+..>....@......A......B.......C.......D...3...E...Z...F......G......H.......I.......P.......Q...D...R.......S......T.......U.......V...1...W...X...X.......Y......]...Y...t..D-......K....;...3...;.......;.......;......;...V...M.......O.._ ......l....}.......m...........T..(5...(..+;......+;..%...+O......1......E@...k..F.......H4..?I..HY..@7..H...J...I....,..IC..HT..J...H{..J...H...LD..J"..L...Jv..PS..Q...R...D...Zr..i]..[`..7...\...nB.._...o...1...&....E..(........B......19......A.......A....$..AF...[..C....,..D....y..G.......v........g......G....9..A....E..........IH...%..4.......Kf..............................5..K....0...,...0.......0.......0..Of...0.......5..P....5..........E... D...C.. D..?'..+...Y`..<U......<U..\...<...]...H5...m..H5..?...L...^...VE......f.......f...8...g.......l...aP.......................6......d....D..f(...`..f...............?....`..h5...y..H....5..j........E...e.......e..@....... ......>......oZ......l..

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\translations\qtbase_tr.qm

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):194487
                                                                                                                                                                                                                                                      Entropy (8bit):4.877239354585035
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:3072:yRRhAFCvqDBitD/iDG9AOH+l4TcwZBPqHo9fd9CFRK+2IKAimxsjucV2p0ZqvRu7:yRRHs5mksWVX3lA3
                                                                                                                                                                                                                                                      MD5:6CBC5D8E1EABEC96C281065ECC51E35E
                                                                                                                                                                                                                                                      SHA1:4E1E6BA3772428227CB033747006B4887E5D9AD1
                                                                                                                                                                                                                                                      SHA-256:6A0BF6E70E7920C2B193E76E92F78F315936955D3B06AC039D917F2E06C43281
                                                                                                                                                                                                                                                      SHA-512:CE1F9EE180176153D5F523D71E0DB06F4DEA65C24E5E2CD56341CFAEE349A8E9A0F606D99F7219A35DD4516D1528C90AEA4BB87548A55392B8F2B36164D478B1
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:<.d....!..`.......tr_TRB..7....*.......+...-...@.......A.......B.......C...%...D.......E...F...F.......G.......H.......I.......P.. ....Q.. ....R..!D...S..!h...T..!....U..!....V.."....W.."0...X.."T...Y.."x...]..,g...s.../...t......................;..,9...;..-I...;..9@...;..E....M..,....O.......O...G...........}..,............=...\...m..,....t.........._3..(5..LJ..+;..Wt..+;...\..+O..7...1..._...D@......E@..!...H4...@..HY..t...H....2..IC...r..J......J....D..J....K..LD...$..L....x..PS......QR..!...R...x...T.......U....q..U...Y...X...."..Zr...%..[`......\....:..]x......_......._.......yg..6...1...X....E..[....7...Z......7Q......f............................$..u....[...:...,...5...y.......y...........7...............!...9..u....E...........P...z.. ........p...........%..j....D..................A.....U......Y......_....5...V...0.......0..8....0...U...0.......5.......5..~b..............z+.. D..-... D..s...+.......<?...8..<U...s..<U...p..<.......H5..-...H5..s...L.......VE.."0..V...4..

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\translations\qtbase_uk.qm

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):158274
                                                                                                                                                                                                                                                      Entropy (8bit):5.402056706327934
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:1536:jXwjFVUDdMUD4TzdAhpQgO5poZHvJllEnhmdK4I77/dnPJX/imfb1jhvv3BxT8ue:jBzD4Tzaw5pCvJ8hVPdlvj3p8
                                                                                                                                                                                                                                                      MD5:D6234E4E21021102B021744D5FA22346
                                                                                                                                                                                                                                                      SHA1:63A14327D0CF0941D6D6B58BFA7E8B10337F557B
                                                                                                                                                                                                                                                      SHA-256:51B8FF55B37DC5907D637A8DDDA12FBE816852B0244C74EB4F0FB84867A786E0
                                                                                                                                                                                                                                                      SHA-512:37D24A092C5F29BACB7A4CA8207C4EEFD0F073B7E74A492402867F758084091BF1D79D2BA2B4A28B35FEF42E8023C371FDE97578F74BB2033551154E77102DE6
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:<.d....!..`.......uk_UAB../....*...E...+...l...@.......A.......B...G...C...k...D.......E.......F.......G.......H...*...I...N...P...=...Q...a...R.......S.......T.......U.......V...r...W.......X.......Y.......]..*y...s.......t...........;.......n...;..*Q...;..+U...;.......;...x...;..!(...M..*....O.......O...........6...}..*........E...=.......m..*....t..........3...(5..&...+;..:...+;..k0..+O...A..1...4-..D@... ..E@......H4...8..HY..W...H....2..IC...V..J....}..J.......J....%..LD...&..L....z..PS......QR.. ...R...\...T....(..U.......X.......Zr......[`..~...\.......]x......_......._....4..yg...c..1...;....E..=w.......m......I............................$..X....[...<...,.......y.......y...........M...................9..Y....E...F.......D...z.. ........P...........%..LB...D.......................-n...../......4W...5...F...0...p...0...W...0.......0...k...0.......5.......5..................^... D..+... D..V...+.......<U.../..<U......<....>..H5..+...H5..V...L....S..VE..!...VE..0...V......

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\Qt5\translations\qtbase_zh_TW.qm

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):127849
                                                                                                                                                                                                                                                      Entropy (8bit):5.83455389078597
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:3072:Fv2cHP10gOs6dcFxsJopMqOWv2WIrPFP8pa:Fh6s6iFxEodjef8pa
                                                                                                                                                                                                                                                      MD5:9C6A3721D01ECAF3F952CE96F46CE046
                                                                                                                                                                                                                                                      SHA1:4A944E9E31DF778F7012D8E4A66497583BFD2118
                                                                                                                                                                                                                                                      SHA-256:085D29EAF9BBB788B2F2503D74A1EF963A9411CEB600441254CE49A120E1AB63
                                                                                                                                                                                                                                                      SHA-512:6E2807B8785F42A26C9CCBDBA0327DD40B529B10C468593F0E74113774D1CCDAA4FD9ACE9B259B9040E1475911428ECAEA49425B0F170862CF8147D23DB48E46
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:<.d....!..`.......zh_TWB..2x...*.......+..)....@.......A.......B...j...C......D.......E......F.......G...)...H...M...I...q...P...%...Q...I...R......S......T.......U.......V...Z...W...~...X......Y.......]..!....s.......t..-...............4....;..!z...;.."|...;.......;.......M..!....O.......O..Ay......N)...}..!............=.......m.." ...t...(.........(5......+;..;...+;.._...+O......1.......D@...C..E@...m..H4..*W..HY..Pm..H...3...IC..1...J...1...J.......J...1...LD..2...L...38..PS..6...QR...T..R...T...T...A...U...A...X...E...Zr..K...[`..$...\...OW..]x......_......._...P...yg..a^..1...<....E..>....7...>.......;......Fo......+.......+.......-L...$..QR...[..-....,...F...y.......y..1J...............6......1p...9..Q....E..........2....z...........<......3....%..H....D..4W......4}....................Z...... ...5..4....0...?...0...K...0..5....0...L...5..6....5..........6.......U... D.."... D..O...+...<%..<U......<U..>...<...?:..H5..#...H5..O...L...AS..VE...M..VE......V.......f...L..

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\QtCore.pyd

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):2483712
                                                                                                                                                                                                                                                      Entropy (8bit):6.241719144701645
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:49152:ZYS8YHrNj4/7RsRLvYpiW3pCBU+Z7bJWvCSBYgbxGJ5M2GM/fXR1fUdihfSbCo6e:9bpj4/7RsRLvYpiW3pCBU+Z7bJWvCSBv
                                                                                                                                                                                                                                                      MD5:678FA1496FFDEA3A530FA146DEDCDBCC
                                                                                                                                                                                                                                                      SHA1:C80D8F1DE8AE06ECF5750C83D879D2DCC2D6A4F8
                                                                                                                                                                                                                                                      SHA-256:D6E45FD8C3B3F93F52C4D1B6F9E3EE220454A73F80F65F3D70504BD55415EA37
                                                                                                                                                                                                                                                      SHA-512:8D9E3FA49FB42F844D8DF241786EA9C0F55E546D373FF07E8C89AAC4F3027C62EC1BD0C9C639AFEABC034CC39E424B21DA55A1609C9F95397A66D5F0D834E88E
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........}.........../....td./..../...td./...td./...td./...n../...1../......P...c./....c./....c./...Rich...........................PE..d....p.f.........." ...(.*...........+.......................................0&...........`.............................................L.....................#.$.............%.... t.......................t..(....r..@............@..(o...........................text...~(.......*.................. ..`.rdata..x....@......................@..@.data...h...........................@....pdata..$.....#......n#.............@..@.reloc.......%......L%.............@..B........................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\QtGui.pyd

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):2494976
                                                                                                                                                                                                                                                      Entropy (8bit):6.232020603277999
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:24576:SUjOoTFrwI8nc6EmRAQ9RzgpP2bXYUKuXeLQp5PjYq0zb:SUqCgnZXRAQ9RzggbozJLQp5Mq
                                                                                                                                                                                                                                                      MD5:AE182C36F5839BADDC9DCB71192CFA7A
                                                                                                                                                                                                                                                      SHA1:C9FA448981BA61343C7D7DECACAE300CAD416957
                                                                                                                                                                                                                                                      SHA-256:A9408E3B15FF3030F0E9ACB3429000D253D3BB7206F750091A7130325F6D0D72
                                                                                                                                                                                                                                                      SHA-512:8950244D828C5EDE5C3934CFE2EE229BE19CC00FBF0C4A7CCEBEC19E8641345EF5FD028511C5428E1E21CE5491A3F74FB0175B03DA17588DAEF918E3F66B206A
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......... j..sj..sj..sc..sn..s.p.rh..s1..rh..s.p.ri..s.p.rb..s.p.r...s...rh..s..ro..sj..s...syw.ra..syw.rk..syw.rk..sRichj..s........PE..d....p.f.........." ...(.....................................................P&...........`.........................................`&..L....&................$...............%.....................................p...@...............@{...........................text...O........................... ..`.rdata..............................@..@.data...xz.......^...t..............@....pdata........$.......#.............@..@.reloc........%......^%.............@..B........................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\QtWidgets.pyd

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):5144576
                                                                                                                                                                                                                                                      Entropy (8bit):6.262739223310643
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:49152:Qi+reIG7QwktsFPKoe2yicbbqgkcY9abW7KnTYK2bjMkTDGM7y:uqT7Q1kyTvoWW7EYvM9M
                                                                                                                                                                                                                                                      MD5:E8C3BFBC19378E541F5F569E2023B7AA
                                                                                                                                                                                                                                                      SHA1:ACA007030C1CEE45CBC692ADCB8BCB29665792BA
                                                                                                                                                                                                                                                      SHA-256:A1E97A2AB434C6AE5E56491C60172E59CDCCE42960734E8BDF5D851B79361071
                                                                                                                                                                                                                                                      SHA-512:9134C2EAD00C2D19DEC499E60F91E978858766744965EAD655D2349FF92834AB267AC8026038E576A7E207D3BBD4A87CD5F2E2846A703C7F481A406130530EB0
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................=....1M............1M.....1M.....1M.....+......t.............J......J......J.....Rich...........................PE..d....p.f.........." ...(..,...!.....P.,.......................................N...........`..........................................><.T...D?<...............H..z...........pM..O..Pa8..............................`8.@.............,..............................text.....,.......,................. ..`.rdata........,.......,.............@..@.data... :....A.......A.............@....pdata...z....H..|....H.............@..@.reloc...O...pM..P...0M.............@..B........................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI72562\PyQt5\sip.cp313-win_amd64.pyd

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):120320
                                                                                                                                                                                                                                                      Entropy (8bit):6.034057886020456
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:1536:pPd5NTdYgpmMrZhekwFH4PqgZNBQmT6V6WRFYE9Icx7pz4H5B:NhTdtmMdEkwuFTSvYE9Iczz4H5
                                                                                                                                                                                                                                                      MD5:4F7F9E3A9466F4C0103FB04E1987E098
                                                                                                                                                                                                                                                      SHA1:D4A339702E936AA5ECC1FE906AE2BA3BB0E481D7
                                                                                                                                                                                                                                                      SHA-256:EBF27146466D61411493D2E243EAC691740F9C4B7A4B9AB0D408BE45B5E0AA35
                                                                                                                                                                                                                                                      SHA-512:920BA8D58DCA7946341C1CC01FEA0B76CCE008F1D10061F84455A3DE9BA00FD9534F40C983486211BE92B85F786CD610C386529711A6F573A02BFAF8CA543A19
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........kSR...R...R...[...Z....X..P.......P....X..Q....X..Z....X.._....^..Q...R.......G_..[...G_..S...G_..S...G_..S...RichR...........PE..d.... g.........." ...(.H...........J.......................................0............`.............................................X...h................................ ..........................................@............`...............................text...(G.......H.................. ..`.rdata..lU...`...V...L..............@..@.data.... ..........................@....pdata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI72562\VCRUNTIME140.dll

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):120400
                                                                                                                                                                                                                                                      Entropy (8bit):6.6017475353076716
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:1536:N9TXF5LLXQLlNycKW+D4SdqJk6aN1ACuyxLiyazYaCVoecbdhgOwAd+zfZ1zu:N9jelDoD9uyxLizzFzecbdPwA87S
                                                                                                                                                                                                                                                      MD5:862F820C3251E4CA6FC0AC00E4092239
                                                                                                                                                                                                                                                      SHA1:EF96D84B253041B090C243594F90938E9A487A9A
                                                                                                                                                                                                                                                      SHA-256:36585912E5EAF83BA9FEA0631534F690CCDC2D7BA91537166FE53E56C221E153
                                                                                                                                                                                                                                                      SHA-512:2F8A0F11BCCC3A8CB99637DEEDA0158240DF0885A230F38BB7F21257C659F05646C6B61E993F87E0877F6BA06B347DDD1FC45D5C44BC4E309EF75ED882B82E4E
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......\=..\...\...\..S$...\...$...\...\..5\...\...\.....\.....\.....\.....\......\.....\..Rich.\..........PE..d.....x.........." ...).$...d............................................................`A........................................0u..4...d}..........................PP...........^..p............................\..@............@...............................text............................... ..`fothk........0...................... ..`.rdata...C...@...D...(..............@..@.data................l..............@....pdata...............p..............@..@_RDATA...............|..............@..@.rsrc................~..............@..@.reloc..............................@..B................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI72562\VCRUNTIME140_1.dll

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):49744
                                                                                                                                                                                                                                                      Entropy (8bit):6.701724666218339
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:768:ApzzO6ujT3MbR3v0Cz6SR8q83yaFdWr9zRcmgEl6U9zSC:9q/oGw3fFdwzRcmZFzSC
                                                                                                                                                                                                                                                      MD5:68156F41AE9A04D89BB6625A5CD222D4
                                                                                                                                                                                                                                                      SHA1:3BE29D5C53808186EBA3A024BE377EE6F267C983
                                                                                                                                                                                                                                                      SHA-256:82A2F9AE1E6146AE3CB0F4BC5A62B7227E0384209D9B1AEF86BBCC105912F7CD
                                                                                                                                                                                                                                                      SHA-512:F7BF8AD7CD8B450050310952C56F6A20B378A972C822CCC253EF3D7381B56FFB3CA6CE3323BEA9872674ED1C02017F78AB31E9EB9927FC6B3CBA957C247E5D57
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......?.{...{...{...0...y.......y...r.H.p...{...H.......|.......`.......~.......z.....$.z.......z...Rich{...........PE..d...l0.?.........." ...).<...8.......@...............................................b....`A........................................pm.......m..x....................r..PP......D....c..p...........................`b..@............P..`............................text....;.......<.................. ..`.rdata.."#...P...$...@..............@..@.data................d..............@....pdata...............f..............@..@.rsrc................l..............@..@.reloc..D............p..............@..B................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI72562\_bz2.pyd

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):84240
                                                                                                                                                                                                                                                      Entropy (8bit):6.607563436050078
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:1536:Kdrz7l1EVLsSuvX3dUK4MLgqK7YEog8y5sV8lIJLVy7SyFB:urzcuvXvrEo7y6V8lIJLVyB
                                                                                                                                                                                                                                                      MD5:CB8C06C8FA9E61E4AC5F22EEBF7F1D00
                                                                                                                                                                                                                                                      SHA1:D8E0DFC8127749947B09F17C8848166BAC659F0D
                                                                                                                                                                                                                                                      SHA-256:FC3B481684B926350057E263622A2A5335B149A0498A8D65C4F37E39DD90B640
                                                                                                                                                                                                                                                      SHA-512:E6DA642B7200BFB78F939F7D8148581259BAA9A5EDDA282C621D14BA88083A9B9BD3D17B701E9CDE77AD1133C39BD93FC9D955BB620546BB4FCF45C68F1EC7D6
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......e...!m..!m..!m..(.o.+m..1...#m..1..."m..1...%m..1...)m..1...,m..i..."m..j...#m..!m..|m..i...)m..i... m..i... m..i... m..Rich!m..........PE..d.....g.........." ...).....\......0........................................P......7[....`.............................................H...(........0....... .. ......../...@..........T...........................`...@...............x............................text............................... ..`.rdata...=.......>..................@..@.data...............................@....pdata.. .... ......................@..@.rsrc........0......................@..@.reloc.......@......................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI72562\_ctypes.pyd

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):131344
                                                                                                                                                                                                                                                      Entropy (8bit):6.311142284249784
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:3072:3RF024DWkT/DKGkXY402iXnVJf/FO50XnekZ39gPhvEQZIJyPArm:j0nHT/DKFXZorf/FO50uW3SEQt
                                                                                                                                                                                                                                                      MD5:A55E57D7594303C89B5F7A1D1D6F2B67
                                                                                                                                                                                                                                                      SHA1:904A9304A07716497CF3E4EAAFD82715874C94F1
                                                                                                                                                                                                                                                      SHA-256:F63C6C7E71C342084D8F1A108786CA6975A52CEFEF8BE32CC2589E6E2FE060C8
                                                                                                                                                                                                                                                      SHA-512:FFA61AD2A408A831B5D86B201814256C172E764C9C1DBE0BD81A2E204E9E8117C66F5DFA56BB7D74275D23154C0ED8E10D4AE8A0D0564434E9761D754F1997FC
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........h~..............q...............................................q.......q......!u.............................................Rich....................PE..d.....g.........." ...).............h....................................... .......Z....`.........................................P.................................../...........=..T............................;..@............0...............................text............................... ..`.rdata...y...0...z..................@..@.data....$....... ..................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI72562\_decimal.pyd

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):277776
                                                                                                                                                                                                                                                      Entropy (8bit):6.5855511991551
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:6144:x9iD78EIq4x4OA5bZZ0KDgQcI79qWM53pLW1AFR8E4wXw76TPlpV77777VMvyk:xwDGqr5b8EgQ5+w6k
                                                                                                                                                                                                                                                      MD5:F3377F3DE29579140E2BBAEEFD334D4F
                                                                                                                                                                                                                                                      SHA1:B3076C564DBDFD4CA1B7CC76F36448B0088E2341
                                                                                                                                                                                                                                                      SHA-256:B715D1C18E9A9C1531F21C02003B4C6726742D1A2441A1893BC3D79D7BB50E91
                                                                                                                                                                                                                                                      SHA-512:34D9591590BBA20613691A5287EF329E5927A58127CE399088B4D68A178E3AF67159A8FC55B4FCDCB08AE094753B20DEC2AC3F0B3011481E4ED6F37445CECDD5
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........j2U..\...\...\..s....\..]...\.._...\..X...\..Y...\...]...\..s]...\...].z.\..._...\...Q...\...\...\.......\...^...\.Rich..\.........................PE..d......g.........." ...).....Z...............................................P......W.....`.................................................L........0..........t+......./...@..........T...............................@............... ............................text.............................. ..`.rdata..\...........................@..@.data...8'......."..................@....pdata..t+.......,..................@..@.rsrc........0......................@..@.reloc.......@......................@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI72562\_hashlib.pyd

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):64272
                                                                                                                                                                                                                                                      Entropy (8bit):6.220967684620152
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:768:eNJI0DWiflFwY9X3Th1JnptE462TxNvdbj4dIJvI75YiSyvE62Em:2LDxflFwY9XDhPfVNv+dIJvIF7Syc6c
                                                                                                                                                                                                                                                      MD5:32D76C9ABD65A5D2671AEEDE189BC290
                                                                                                                                                                                                                                                      SHA1:0D4440C9652B92B40BB92C20F3474F14E34F8D62
                                                                                                                                                                                                                                                      SHA-256:838D5C8B7C3212C8429BAF612623ABBBC20A9023EEC41E34E5461B76A285B86C
                                                                                                                                                                                                                                                      SHA-512:49DC391F4E63F4FF7D65D6FD837332745CC114A334FD61A7B6AA6F710B235339964B855422233FAC4510CCB9A6959896EFE880AB24A56261F78B2A0FD5860CD9
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........W.A.6...6...6...N%..6.......6.......6.......6.......6.......6...N...6.......6...6..26.......6.......6....I..6.......6..Rich.6..........PE..d......g.........." ...).P...~.......=..............................................!.....`.........................................p...P................................/......X....l..T............................k..@............`...............................text....N.......P.................. ..`.rdata...M...`...N...T..............@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..X...........................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI72562\_lzma.pyd

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):157968
                                                                                                                                                                                                                                                      Entropy (8bit):6.854644275249963
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:3072:KbbS4R/G4Z8r7NjwJTSUqCRY4By7znfB9mNowgn0lCelIJ012+j:KbR/8oWeBi5YOwflCe8o
                                                                                                                                                                                                                                                      MD5:1BA022D42024A655CF289544AE461FB8
                                                                                                                                                                                                                                                      SHA1:9772A31083223ECF66751FF3851D2E3303A0764C
                                                                                                                                                                                                                                                      SHA-256:D080EABD015A3569813A220FD4EA74DFF34ED2A8519A10473EB37E22B1118A06
                                                                                                                                                                                                                                                      SHA-512:2B888A2D7467E29968C6BB65AF40D4B5E80722FFDDA760AD74C912F3A2F315D402F3C099FDE82F00F41DE6C9FAAEDB23A643337EB8821E594C567506E3464C62
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........7...V.,.V.,.V.,...,.V.,..-.V.,..-.V.,..-.V.,..-.V.,..-.V.,...-.V.,.V.,.V.,..-.V.,..-.V.,..u,.V.,..-.V.,Rich.V.,................PE..d......g.........." ...).`...........1.......................................p.......P....`.............................................L.......x....P.......0.......:.../...`..4....|..T...........................P{..@............p...............................text...^^.......`.................. ..`.rdata.......p.......d..............@..@.data........ ......................@....pdata.......0......................@..@.rsrc........P......................@..@.reloc..4....`.......8..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI72562\_queue.pyd

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):33552
                                                                                                                                                                                                                                                      Entropy (8bit):6.446391764486538
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:384:7GpPCRjqMu/AoS6rf7sif0NHQibZIJ9UoOHQIYiSy1pCQ5xX1rSJIVE8E9VF0Nyf:fkTM6rg9aeZIJ9Uok5YiSyvTo2Et
                                                                                                                                                                                                                                                      MD5:1C03CAA59B5E4A7FB9B998D8C1DA165A
                                                                                                                                                                                                                                                      SHA1:8A318F80A705C64076E22913C2206D9247D30CD7
                                                                                                                                                                                                                                                      SHA-256:B9CF502DADCB124F693BF69ECD7077971E37174104DBDA563022D74961A67E1E
                                                                                                                                                                                                                                                      SHA-512:783ECDA7A155DFC96A718D5A130FB901BBECBED05537434E779135CBA88233DD990D86ECA2F55A852C9BFB975074F7C44D8A3E4558D7C2060F411CE30B6A915F
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........T...........-.........................................................................A...........Rich...................PE..d.....g.........." ...).....:.......................................................r....`.........................................PD..L....D..d....p.......`..l....T.../..........@4..T............................3..@............0...............................text............................... ..`.rdata..2....0....... ..............@..@.data........P.......>..............@....pdata..l....`.......D..............@..@.rsrc........p.......H..............@..@.reloc...............R..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI72562\_socket.pyd

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):83728
                                                                                                                                                                                                                                                      Entropy (8bit):6.331814573029388
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:1536:XuV3gvWHQdMq3ORC/OypTXQlyJ+9+nzEYwsBI6tzOKuZIJywJ7Sy21:XuVQvcQTSypTXQlyJs+nzEYJI6QlZIJY
                                                                                                                                                                                                                                                      MD5:FE896371430BD9551717EF12A3E7E818
                                                                                                                                                                                                                                                      SHA1:E2A7716E9CE840E53E8FC79D50A77F40B353C954
                                                                                                                                                                                                                                                      SHA-256:35246B04C6C7001CA448554246445A845CE116814A29B18B617EA38752E4659B
                                                                                                                                                                                                                                                      SHA-512:67ECD9A07DF0A07EDD010F7E3732F3D829F482D67869D6BCE0C9A61C24C0FDC5FF4F4E4780B9211062A6371945121D8883BA2E9E2CF8EB07B628547312DFE4C9
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............ll}.ll}.ll}...}.ll}..m|.ll}..o|.ll}..h|.ll}..i|.ll}..m|.ll}.lm}.ll}..m|.ll}..a|.ll}..l|.ll}..}.ll}..n|.ll}Rich.ll}........PE..d.....g.........." ...).x.......... -.......................................`.......s....`.........................................@...P............@.......0.........../...P..........T...........................@...@............................................text....w.......x.................. ..`.rdata.. y.......z...|..............@..@.data...............................@....pdata.......0......................@..@.rsrc........@......................@..@.reloc.......P......................@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI72562\_ssl.pyd

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):181520
                                                                                                                                                                                                                                                      Entropy (8bit):5.972827303352998
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:3072:kO+IWyXHllRhN1qhep7fM6CpqjZI8u7pUULbaLZErWreVEzvT3iFCNc6tYwJc1OW:kpSrhN1E2M6CpUuwg5dEW7
                                                                                                                                                                                                                                                      MD5:1C0E3E447F719FBE2601D0683EA566FC
                                                                                                                                                                                                                                                      SHA1:5321AB73B36675B238AB3F798C278195223CD7B1
                                                                                                                                                                                                                                                      SHA-256:63AE2FEFBFBBBC6EA39CDE0A622579D46FF55134BC8C1380289A2976B61F603E
                                                                                                                                                                                                                                                      SHA-512:E1A430DA2A2F6E0A1AED7A76CC4CD2760B3164ABC20BE304C1DB3541119942508E53EA3023A52B8BADA17A6052A7A51A4453EFAD1A888ACB3B196881226C2E5C
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......FM.^.,k..,k..,k..T...,k...j..,k...h..,k...o..,k...n..,k.J.j..,k...j..,k..,j..-k.ITj..,k.J.f..,k.J.k..,k.J....,k.J.i..,k.Rich.,k.................PE..d......g.........." ...)............ /..............................................R\....`.............................................d................................/..............T...........................P...@............................................text...0........................... ..`.rdata..D%.......&..................@..@.data...`...........................@....pdata...............n..............@..@.rsrc................z..............@..@.reloc..............................@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI72562\_wmi.pyd

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):38160
                                                                                                                                                                                                                                                      Entropy (8bit):6.338856805460127
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:768:fEkK9VgWOZbs3550QcJpPllIJLiX5YiSyvQ602Euf0:fE93jkbQcJvlIJLiJ7Syq00
                                                                                                                                                                                                                                                      MD5:1C30CC7DF3BD168D883E93C593890B43
                                                                                                                                                                                                                                                      SHA1:31465425F349DAE4EDAC9D0FEABC23CE83400807
                                                                                                                                                                                                                                                      SHA-256:6435C679A3A3FF4F16708EBC43F7CA62456C110AC1EA94F617D8052C90C143C7
                                                                                                                                                                                                                                                      SHA-512:267A1807298797B190888F769D998357B183526DFCB25A6F1413E64C5DCCF87F51424B7E5D6F2349D7A19381909AB23B138748D8D9F5858F7DC0552F5C5846AC
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........H2.&a.&a.&a..a.&a..'`.&a..%`.&a.."`.&a..'`.&a..#`.&a..'`.&a.'a..&a.."`.&a../`.&a..&`.&a...a.&a..$`.&aRich.&a................PE..d.....g.........." ...).,...<.......)..............................................'.....`.........................................0V..H...xV.......................f.../......x...tG..T............................C..@............@.......T..@....................text....*.......,.................. ..`.rdata..d ...@..."...0..............@..@.data........p.......R..............@....pdata...............V..............@..@.rsrc................Z..............@..@.reloc..x............d..............@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI72562\base_library.zip

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):1394456
                                                                                                                                                                                                                                                      Entropy (8bit):5.531698507573688
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:12288:IW7WpLV6yNLeGQbVz3YQfiBgDPtLwjFx278e6ZQnHS91lqyL+DXUgnxOr+dx5/GO:B7WpLtHa9BHSHAW+dx5/GP05vddD
                                                                                                                                                                                                                                                      MD5:A9CBD0455B46C7D14194D1F18CA8719E
                                                                                                                                                                                                                                                      SHA1:E1B0C30BCCD9583949C247854F617AC8A14CBAC7
                                                                                                                                                                                                                                                      SHA-256:DF6C19637D239BFEDC8CD13D20E0938C65E8FDF340622FF334DB533F2D30FA19
                                                                                                                                                                                                                                                      SHA-512:B92468E71490A8800E51410DF7068DD8099E78C79A95666ECF274A9E9206359F049490B8F60B96081FAFD872EC717E67020364BCFA972F26F0D77A959637E528
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:PK..........!..b.e............_collections_abc.pyc......................................\.....S.r.S.S.K.J.r.J.r. .S.S.K.r.\.".\.\.....5.......r.\.".S.5.......r.S...r.\.".\.5.......r.C./.S.Q.r.S.r.\.".\.".S.5.......5.......r.\.".\.".\.".5.......5.......5.......r.\.".\.".0.R%..................5.......5.......5.......r.\.".\.".0.R)..................5.......5.......5.......r.\.".\.".0.R-..................5.......5.......5.......r.\.".\."./.5.......5.......r.\.".\.".\."./.5.......5.......5.......r.\.".\.".\.".S.5.......5.......5.......r.\.".\.".\.".S.S.-...5.......5.......5.......r.\.".\.".\.".5.......5.......5.......r.\.".\.".S.5.......5.......r \.".\.".S.5.......5.......r!\.".\.".\"".5.......5.......5.......r#\.".0.R%..................5.......5.......r$\.".0.R)..................5.......5.......r%\.".0.R-..................5.......5.......r&\.".\.RN..................5.......r(S...r)\)".5.......r*C)\.".S...".5.......5.......r+S...r,\,".5.......r,\.".\,5.......r-\,R]..................5.......

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI72562\certifi\cacert.pem

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:ASCII text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):299427
                                                                                                                                                                                                                                                      Entropy (8bit):6.047872935262006
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:6144:QW1x/M8fRR1jplkXURrVADwYCuCigT/QRSRqNb7d8iu5Nahx:QWb/TRJLWURrI5RWavdF08/
                                                                                                                                                                                                                                                      MD5:50EA156B773E8803F6C1FE712F746CBA
                                                                                                                                                                                                                                                      SHA1:2C68212E96605210EDDF740291862BDF59398AEF
                                                                                                                                                                                                                                                      SHA-256:94EDEB66E91774FCAE93A05650914E29096259A5C7E871A1F65D461AB5201B47
                                                                                                                                                                                                                                                      SHA-512:01ED2E7177A99E6CB3FBEF815321B6FA036AD14A3F93499F2CB5B0DAE5B713FD2E6955AA05F6BDA11D80E9E0275040005E5B7D616959B28EFC62ABB43A3238F0
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:.# Issuer: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Subject: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Label: "GlobalSign Root CA".# Serial: 4835703278459707669005204.# MD5 Fingerprint: 3e:45:52:15:09:51:92:e1:b7:5d:37:9f:b1:87:29:8a.# SHA1 Fingerprint: b1:bc:96:8b:d4:f4:9d:62:2a:a8:9a:81:f2:15:01:52:a4:1d:82:9c.# SHA256 Fingerprint: eb:d4:10:40:e4:bb:3e:c7:42:c9:e3:81:d3:1e:f2:a4:1a:48:b6:68:5c:96:e7:ce:f3:c1:df:6c:d4:33:1c:99.-----BEGIN CERTIFICATE-----.MIIDdTCCAl2gAwIBAgILBAAAAAABFUtaw5QwDQYJKoZIhvcNAQEFBQAwVzELMAkG.A1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExEDAOBgNVBAsTB1Jv.b3QgQ0ExGzAZBgNVBAMTEkdsb2JhbFNpZ24gUm9vdCBDQTAeFw05ODA5MDExMjAw.MDBaFw0yODAxMjgxMjAwMDBaMFcxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9i.YWxTaWduIG52LXNhMRAwDgYDVQQLEwdSb290IENBMRswGQYDVQQDExJHbG9iYWxT.aWduIFJvb3QgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDaDuaZ.jc6j40+Kfvvxi4Mla+pIH/EqsLmVEQS98GPR4mdmzxzdzxtIK+6NiY6arymAZavp.xy0Sy6scTHAHoT0KMM0VjU/43dSMUBUc71DuxC73/OlS8pF94G3VNTCOXkNz

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI72562\charset_normalizer\md.cp313-win_amd64.pyd

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):10752
                                                                                                                                                                                                                                                      Entropy (8bit):4.818583535960129
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:96:Mvs10hZd9D74ACb0xx2uKynu10YLsgxwJiUNiL0U5IZsJFPGDtCFCCQAADo+cX6m:MXv9XFCk2z1/t12iwU5usJFuCyPcqgE
                                                                                                                                                                                                                                                      MD5:56FE4F6C7E88212161F49E823CCC989A
                                                                                                                                                                                                                                                      SHA1:16D5CBC5F289AD90AEAA4FF7CB828627AC6D4ACF
                                                                                                                                                                                                                                                      SHA-256:002697227449B6D69026D149CFB220AC85D83B13056C8AA6B9DAC3FD3B76CAA4
                                                                                                                                                                                                                                                      SHA-512:7C9D09CF9503F73E6F03D30E54DBB50606A86D09B37302DD72238880C000AE2B64C99027106BA340753691D67EC77B3C6E5004504269508F566BDB5E13615F1E
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........k............r_...........r................................................3..........Rich....................PE..d....$.g.........." ...).....................................................p............`..........................................'..p...`(..d....P.......@...............`..,...`#.............................. "..@............ ...............................text............................... ..`.rdata....... ......................@..@.data........0......."..............@....pdata.......@.......$..............@..@.rsrc........P.......&..............@..@.reloc..,....`.......(..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI72562\charset_normalizer\md__mypyc.cp313-win_amd64.pyd

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):124928
                                                                                                                                                                                                                                                      Entropy (8bit):5.953784637413928
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:3072:JDE+0ov6ojgN3qN8h51Zlh+YW5E38vCsmLS:JdefPZE2ICDLS
                                                                                                                                                                                                                                                      MD5:10116447F9276F10664BA85A5614BA3A
                                                                                                                                                                                                                                                      SHA1:EFD761A3E6D14E897D37AFB0C7317C797F7AE1D6
                                                                                                                                                                                                                                                      SHA-256:C393098E7803ABF08EE8F7381AD7B0F8FAFFBF66319C05D72823308E898F8CFC
                                                                                                                                                                                                                                                      SHA-512:C04461E52B7FE92D108CBDEB879B7A8553DD552D79C88DFA3F5D0036EED8D4B8C839C0BF2563BC0C796F8280ED2828CA84747CB781D2F26B44214FCA2091EAE4
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........y.....................7...............7.......7.......7.......6..........D....6.......6.......6.......6......Rich............................PE..d....$.g.........." ...).@...........C.......................................0............`.........................................0...d.................................... ......................................P...@............P...............................text....?.......@.................. ..`.rdata..nY...P...Z...D..............@..@.data....=.......0..................@....pdata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI72562\libcrypto-3.dll

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):5232408
                                                                                                                                                                                                                                                      Entropy (8bit):5.940072183736028
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:98304:/V+Qs2NuR5YV0L8PQ1CPwDvt3uFlDC4SC9c:9rs2NuDYV0L841CPwDvt3uFlDC4SCa
                                                                                                                                                                                                                                                      MD5:123AD0908C76CCBA4789C084F7A6B8D0
                                                                                                                                                                                                                                                      SHA1:86DE58289C8200ED8C1FC51D5F00E38E32C1AAD5
                                                                                                                                                                                                                                                      SHA-256:4E5D5D20D6D31E72AB341C81E97B89E514326C4C861B48638243BDF0918CFA43
                                                                                                                                                                                                                                                      SHA-512:80FAE0533BA9A2F5FA7806E86F0DB8B6AAB32620DDE33B70A3596938B529F3822856DE75BDDB1B06721F8556EC139D784BC0BB9C8DA0D391DF2C20A80D33CB04
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........._~.._~.._~..V.S.M~.....]~.....[~.....W~.....S~.._~...~......T~..J....~..J...7}..J...^~..J.?.^~..J...^~..Rich_~..........................PE..d......f.........." ...(..7..<......v........................................0P.......O...`...........................................H.0.....O.@....@O.|.... L. .....O../...PO.$...`{D.8............................yD.@.............O..............................text.....7.......7................. ..`.rdata........7.......7.............@..@.data...Ao....K..<....K.............@....pdata....... L.......K.............@..@.idata...%....O..&....N.............@..@.00cfg..u....0O.......N.............@..@.rsrc...|....@O.......N.............@..@.reloc..~....PO.......N.............@..B................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI72562\libffi-8.dll

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):39696
                                                                                                                                                                                                                                                      Entropy (8bit):6.641880464695502
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
                                                                                                                                                                                                                                                      MD5:0F8E4992CA92BAAF54CC0B43AACCCE21
                                                                                                                                                                                                                                                      SHA1:C7300975DF267B1D6ADCBAC0AC93FD7B1AB49BD2
                                                                                                                                                                                                                                                      SHA-256:EFF52743773EB550FCC6CE3EFC37C85724502233B6B002A35496D828BD7B280A
                                                                                                                                                                                                                                                      SHA-512:6E1B223462DC124279BFCA74FD2C66FE18B368FFBCA540C84E82E0F5BCBEA0E10CC243975574FA95ACE437B9D8B03A446ED5EE0C9B1B094147CEFAF704DFE978
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........iV...8...8...8..p....8.t9...8.p9...8...9...8.t=...8.t<...8.t;...8.1t<...8.1t;...8.1t8...8.1t:...8.Rich..8.........................PE..d...Sh.c.........." ...".H...(.......L...............................................n....`......................................... l.......p..P...............P....l.../......,...@d...............................c..@............`.. ............................text....G.......H.................. ..`.rdata..h....`.......L..............@..@.data................b..............@....pdata..P............d..............@..@.reloc..,............j..............@..B................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI72562\libssl-3.dll

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):792856
                                                                                                                                                                                                                                                      Entropy (8bit):5.57949182561317
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:12288:7LN1sdyIzHHZp5c3nlUa6lxzAG11rbmFe9Xbv:7LgfzH5I3nlUa2AU2Fe9Xbv
                                                                                                                                                                                                                                                      MD5:4FF168AAA6A1D68E7957175C8513F3A2
                                                                                                                                                                                                                                                      SHA1:782F886709FEBC8C7CEBCEC4D92C66C4D5DBCF57
                                                                                                                                                                                                                                                      SHA-256:2E4D35B681A172D3298CAF7DC670451BE7A8BA27C26446EFC67470742497A950
                                                                                                                                                                                                                                                      SHA-512:C372B759B8C7817F2CBB78ECCC5A42FA80BDD8D549965BD925A97C3EEBDCE0335FBFEC3995430064DEAD0F4DB68EBB0134EB686A0BE195630C49F84B468113E3
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........l.>..|m..|m..|m.u.m..|m+.}l..|m.u}l..|m+..l..|m+.xl..|m+.yl..|m..}l..|m..}m..|m..xl..|m..|l..|m...m..|m..~l..|mRich..|m................PE..d......f.........." ...(.>..........K........................................0......!+....`..........................................x...Q..............s.... ...M......./......d...p...8...............................@............................................text....<.......>.................. ..`.rdata..hz...P...|...B..............@..@.data...qN.......H..................@....pdata..pV... ...X..................@..@.idata...c.......d...^..............@..@.00cfg..u...........................@..@.rsrc...s...........................@..@.reloc..C...........................@..B........................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI72562\psutil\_psutil_windows.pyd

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):67072
                                                                                                                                                                                                                                                      Entropy (8bit):5.909456553599775
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:1536:j3sHmR02IvVxv7WCyKm7c5Th4JBHTOvyyaZE:jnIvryCyKx5Th4J5OvyyO
                                                                                                                                                                                                                                                      MD5:49AC12A1F10AB93FAFAB064FD0523A63
                                                                                                                                                                                                                                                      SHA1:3AD6923AB0FB5D3DD9D22ED077DB15B42C2FBD4F
                                                                                                                                                                                                                                                      SHA-256:BA033B79E858DBFCBA6BF8FB5AFE10DEFD1CB03957DBBC68E8E62E4DE6DF492D
                                                                                                                                                                                                                                                      SHA-512:1BC0F50E0BB0A9D9DDDAD31390E5C73B0D11C2B0A8C5462065D477E93FF21F7EDC7AA2B2B36E478BE0A797A38F43E3FBEB6AAABEF0BADEC1D8D16EB73DF67255
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......nT..*5..*5..*5..#M2. 5..x@..(5..x@..&5..x@.."5..x@...5...k..(5..aM..;5..*5...5...@..:5...@..+5...@^.+5...@..+5..Rich*5..................PE..d...._.g.........." .........h......\........................................@............`.........................................0...`.......@.... .......................0..(.......................................8............................................text...h........................... ..`.rdata..\I.......J..................@..@.data...x...........................@....pdata..............................@..@.rsrc........ ......................@..@.reloc..(....0......................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI72562\python3.dll

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):70416
                                                                                                                                                                                                                                                      Entropy (8bit):6.1258200129869405
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:768:pQEotsskOv6pWVCB4p/uKlZPRQcFIc9qunV0Jku/YFI1Hu1wEBbCpVNyD6VdPxiD:/otssyKcunV8PjZIJy0i7SyWH1
                                                                                                                                                                                                                                                      MD5:16855EBEF31C5B1EBE767F1C617645B3
                                                                                                                                                                                                                                                      SHA1:315521F3A748ABFA35CD4D48E8DD09D0556D989B
                                                                                                                                                                                                                                                      SHA-256:A5C6A329698490A035133433928D04368CE6285BB91A9D074FC285DE4C9A32A4
                                                                                                                                                                                                                                                      SHA-512:C3957B3BD36B10C7AD6EA1FF3BC7BD65CDCEB3E6B4195A25D0649AA0DA179276CE170DA903D77B50A38FC3D5147A45BE32DBCFDBFBF76CC46301199C529ADEA4
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%?..a^e.a^e.a^e.).m.`^e.).e.`^e.)..`^e.).g.`^e.Richa^e.........PE..d......g.........." ...)............................................................z.....`.........................................`..................................../..............T............................................................................rdata..............................@..@.rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI72562\python313.dll

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):6083856
                                                                                                                                                                                                                                                      Entropy (8bit):6.126922729922386
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:49152:fXGc3O7T4DKX+vLFMmKYxiAYNBD987KdJlI9HbeX2jrgQcw6Zc4h67mM+XDQ3bLi:Of42zJiwJl/YF7v3vaHDMiEN3Kr
                                                                                                                                                                                                                                                      MD5:B9DE917B925DD246B709BB4233777EFD
                                                                                                                                                                                                                                                      SHA1:775F258D8B530C6EA9F0DD3D1D0B61C1948C25D2
                                                                                                                                                                                                                                                      SHA-256:0C0A66505093B6A4BB3475F716BD3D9552095776F6A124709C13B3F9552C7D99
                                                                                                                                                                                                                                                      SHA-512:F4BF3398F50FDD3AB7E3F02C1F940B4C8B5650ED7AF16C626CCD1B934053BA73A35F96DA03B349C1EB614BB23E0BC6B5CC58B07B7553A5C93C6D23124F324A33
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........s]{v ]{v ]{v M.w!_{v M.. S{v M.u!Y{v M.r!U{v M.s!P{v T.. G{v ..w!V{v ]{w .zv ..{!.{v ..v!\{v ... \{v ..t!\{v Rich]{v ........................PE..d......g.........." ...).:+..T9......J........................................d.....uF]...`...........................................O.....h.P.......d......0].......\../....d..... A3.T.....................I.(....?3.@............P+..............................text....8+......:+................. ..`.rdata....%..P+...%..>+.............@..@.data...$9....P..N....P.............@....pdata.......0]...... U.............@..@PyRuntim.N...._..P....W.............@....rsrc.........d.......[.............@..@.reloc........d.......[.............@..B........................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI72562\select.pyd

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):30992
                                                                                                                                                                                                                                                      Entropy (8bit):6.554484610649281
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:384:7hhxm9tKLhuoNHfzzlvFy0ZZIJ9GckHQIYiSy1pCQ4HWSJIVE8E9VF0Ny6sC:tCytHf98uZIJ9Gx5YiSyvy2ES
                                                                                                                                                                                                                                                      MD5:20831703486869B470006941B4D996F2
                                                                                                                                                                                                                                                      SHA1:28851DFD43706542CD3EF1B88B5E2749562DFEE0
                                                                                                                                                                                                                                                      SHA-256:78E5994C29D8851F28B5B12D59D742D876683AEA58ECEEA1FB895B2036CDCDEB
                                                                                                                                                                                                                                                      SHA-512:4AAF5D66D2B73F939B9A91E7EDDFEB2CE2476C625586EF227B312230414C064AA850B02A4028363AA4664408C9510594754530A6D026A0A84BE0168D677C1BC4
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........tV..'V..'V..'_.j'T..'F:.&T..'F:.&R..'F:.&^..'F:.&Z..'.;.&T..'V..'...'...&S..'.;.&W..'.;.&W..'.;.'W..'.;.&W..'RichV..'................PE..d.....g.........." ...).....2............................................................`..........................................@..L...<A..x....p.......`.......J.../......L....3..T............................2..@............0...............................text............................... ..`.rdata.......0......................@..@.data...p....P.......8..............@....pdata.......`.......:..............@..@.rsrc........p.......>..............@..@.reloc..L............H..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI72562\unicodedata.pyd

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):709904
                                                                                                                                                                                                                                                      Entropy (8bit):5.861739047785334
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:12288:FYGdLI/X77mvfldCKGihH32W3cnPSqrUgLIe:FYGW7qNxr3cnPXLIe
                                                                                                                                                                                                                                                      MD5:0902D299A2A487A7B0C2D75862B13640
                                                                                                                                                                                                                                                      SHA1:04BCBD5A11861A03A0D323A8050A677C3A88BE13
                                                                                                                                                                                                                                                      SHA-256:2693C7EE4FBA55DC548F641C0CB94485D0E18596FFEF16541BD43A5104C28B20
                                                                                                                                                                                                                                                      SHA-512:8CBEF5A9F2D24DA1014F8F1CCBDDD997A084A0B04DD56BCB6AC38DDB636D05EF7E4EA7F67A085363AAD3F43D45413914E55BDEF14A662E80BE955E6DFC2FECA3
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Q.............(.....(.....(.....(.....)................).....).....)x....)....Rich..................PE..d.....g.........." ...).B...f......P,..............................................<.....`.........................................P...X................................/..........p...T...........................0...@............`..h............................text....@.......B.................. ..`.rdata...?...`...@...F..............@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Windows\appcompat\Programs\Amcache.hve

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Windows\System32\WerFault.exe
                                                                                                                                                                                                                                                      File Type:MS Windows registry file, NT/2000 or above
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):1835008
                                                                                                                                                                                                                                                      Entropy (8bit):4.465483375706744
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:6144:YIXfpi67eLPU9skLmb0b4FWSPKaJG8nAgejZMMhA2gX4WABl0uNbdwBCswSbI:NXD94FWlLZMM6YFHp+I
                                                                                                                                                                                                                                                      MD5:588D90CECC9F397DD8528BE143F5EEFB
                                                                                                                                                                                                                                                      SHA1:20830B848610F9397CF8C5175977498CA70A6BCF
                                                                                                                                                                                                                                                      SHA-256:85F84CEE0146605D2978778C731526B9A230630EA3F81D110FF9D5C969267CA8
                                                                                                                                                                                                                                                      SHA-512:4202F43AD84642AF7C85AB235B0C4FFC5E6C5AA1E9DBF17A7D7BBA3FA4ADC08904362FEE90E6254AE658AC6F4E0711F2AA9C8272A9F96D272DFCF8A8E5197901
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:regf6...6....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm...[.R...............................................................................................................................................................................................................................................................................................................................................*.o........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      Static File Info

                                                                                                                                                                                                                                                      General

                                                                                                                                                                                                                                                      File type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                      Entropy (8bit):7.995837929088591
                                                                                                                                                                                                                                                      TrID:
                                                                                                                                                                                                                                                      • Win64 Executable GUI (202006/5) 92.65%
                                                                                                                                                                                                                                                      • Win64 Executable (generic) (12005/4) 5.51%
                                                                                                                                                                                                                                                      • Generic Win/DOS Executable (2004/3) 0.92%
                                                                                                                                                                                                                                                      • DOS Executable Generic (2002/1) 0.92%
                                                                                                                                                                                                                                                      • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                                                                                                                                                                                                                      File name:wp-s2.exe
                                                                                                                                                                                                                                                      File size:38'752'565 bytes
                                                                                                                                                                                                                                                      MD5:62370a84134040d803eae9a4bd34342c
                                                                                                                                                                                                                                                      SHA1:207f73ffdcdfa2cb5d713e13385a8c65bb19adf7
                                                                                                                                                                                                                                                      SHA256:e84a1edd3826ccb96eadc6d62410361e7820f3c5bc8b7ba308278f33aa2266e4
                                                                                                                                                                                                                                                      SHA512:163e43dc823bbbba4a7899a2e50c66f75d5ecfd74c95d0ebb81c508a77ad6eb350412bbf93a0ddf94889ea30781afd02f33f0381371394110f3b79ea51b3a10b
                                                                                                                                                                                                                                                      SSDEEP:786432:/+gX4BMdhwzTQXR5FbPp6FcSS5U/LT2KzVyPVLBdebXMb8VH/zEa:BXGMK4XR3bLSCU/+6yPl3ebcBa
                                                                                                                                                                                                                                                      TLSH:F9873300E5D409DEE5B22974F5F1528BD559F0EE4B72C2EB81B0025385B7BC09B2EA7B
                                                                                                                                                                                                                                                      File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......n=..*\.Z*\.Z*\.Za$.[-\.Za$.[.\.Za$.[ \.Z:..Z)\.Z:..[#\.Z:..[;\.Z:..[.\.Za$.[!\.Z*\.Z.\.Zb..[3\.Zb..[+\.ZRich*\.Z........PE..d..

                                                                                                                                                                                                                                                      File Icon

                                                                                                                                                                                                                                                      Icon Hash:4a464cd47461e179

                                                                                                                                                                                                                                                      Static PE Info

                                                                                                                                                                                                                                                      General

                                                                                                                                                                                                                                                      Entrypoint:0x14000cdb0
                                                                                                                                                                                                                                                      Entrypoint Section:.text
                                                                                                                                                                                                                                                      Digitally signed:false
                                                                                                                                                                                                                                                      Imagebase:0x140000000
                                                                                                                                                                                                                                                      Subsystem:windows gui
                                                                                                                                                                                                                                                      Image File Characteristics:EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
                                                                                                                                                                                                                                                      DLL Characteristics:HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
                                                                                                                                                                                                                                                      Time Stamp:0x67601DBF [Mon Dec 16 12:31:59 2024 UTC]
                                                                                                                                                                                                                                                      TLS Callbacks:
                                                                                                                                                                                                                                                      CLR (.Net) Version:
                                                                                                                                                                                                                                                      OS Version Major:6
                                                                                                                                                                                                                                                      OS Version Minor:0
                                                                                                                                                                                                                                                      File Version Major:6
                                                                                                                                                                                                                                                      File Version Minor:0
                                                                                                                                                                                                                                                      Subsystem Version Major:6
                                                                                                                                                                                                                                                      Subsystem Version Minor:0
                                                                                                                                                                                                                                                      Import Hash:72c4e339b7af8ab1ed2eb3821c98713a

                                                                                                                                                                                                                                                      Entrypoint Preview

                                                                                                                                                                                                                                                      Instruction
                                                                                                                                                                                                                                                      dec eax
                                                                                                                                                                                                                                                      sub esp, 28h
                                                                                                                                                                                                                                                      call 00007F54590C2F3Ch
                                                                                                                                                                                                                                                      dec eax
                                                                                                                                                                                                                                                      add esp, 28h
                                                                                                                                                                                                                                                      jmp 00007F54590C2B5Fh
                                                                                                                                                                                                                                                      int3
                                                                                                                                                                                                                                                      int3
                                                                                                                                                                                                                                                      int3
                                                                                                                                                                                                                                                      int3
                                                                                                                                                                                                                                                      int3
                                                                                                                                                                                                                                                      int3
                                                                                                                                                                                                                                                      int3
                                                                                                                                                                                                                                                      int3
                                                                                                                                                                                                                                                      int3
                                                                                                                                                                                                                                                      int3
                                                                                                                                                                                                                                                      int3
                                                                                                                                                                                                                                                      int3
                                                                                                                                                                                                                                                      int3
                                                                                                                                                                                                                                                      int3
                                                                                                                                                                                                                                                      dec eax
                                                                                                                                                                                                                                                      sub esp, 28h
                                                                                                                                                                                                                                                      call 00007F54590C3308h
                                                                                                                                                                                                                                                      test eax, eax
                                                                                                                                                                                                                                                      je 00007F54590C2D03h
                                                                                                                                                                                                                                                      dec eax
                                                                                                                                                                                                                                                      mov eax, dword ptr [00000030h]
                                                                                                                                                                                                                                                      dec eax
                                                                                                                                                                                                                                                      mov ecx, dword ptr [eax+08h]
                                                                                                                                                                                                                                                      jmp 00007F54590C2CE7h
                                                                                                                                                                                                                                                      dec eax
                                                                                                                                                                                                                                                      cmp ecx, eax
                                                                                                                                                                                                                                                      je 00007F54590C2CF6h
                                                                                                                                                                                                                                                      xor eax, eax
                                                                                                                                                                                                                                                      dec eax
                                                                                                                                                                                                                                                      cmpxchg dword ptr [0003577Ch], ecx
                                                                                                                                                                                                                                                      jne 00007F54590C2CD0h
                                                                                                                                                                                                                                                      xor al, al
                                                                                                                                                                                                                                                      dec eax
                                                                                                                                                                                                                                                      add esp, 28h
                                                                                                                                                                                                                                                      ret
                                                                                                                                                                                                                                                      mov al, 01h
                                                                                                                                                                                                                                                      jmp 00007F54590C2CD9h
                                                                                                                                                                                                                                                      int3
                                                                                                                                                                                                                                                      int3
                                                                                                                                                                                                                                                      int3
                                                                                                                                                                                                                                                      dec eax
                                                                                                                                                                                                                                                      sub esp, 28h
                                                                                                                                                                                                                                                      test ecx, ecx
                                                                                                                                                                                                                                                      jne 00007F54590C2CE9h
                                                                                                                                                                                                                                                      mov byte ptr [00035765h], 00000001h
                                                                                                                                                                                                                                                      call 00007F54590C2435h
                                                                                                                                                                                                                                                      call 00007F54590C3720h
                                                                                                                                                                                                                                                      test al, al
                                                                                                                                                                                                                                                      jne 00007F54590C2CE6h
                                                                                                                                                                                                                                                      xor al, al
                                                                                                                                                                                                                                                      jmp 00007F54590C2CF6h
                                                                                                                                                                                                                                                      call 00007F54590D023Fh
                                                                                                                                                                                                                                                      test al, al
                                                                                                                                                                                                                                                      jne 00007F54590C2CEBh
                                                                                                                                                                                                                                                      xor ecx, ecx
                                                                                                                                                                                                                                                      call 00007F54590C3730h
                                                                                                                                                                                                                                                      jmp 00007F54590C2CCCh
                                                                                                                                                                                                                                                      mov al, 01h
                                                                                                                                                                                                                                                      dec eax
                                                                                                                                                                                                                                                      add esp, 28h
                                                                                                                                                                                                                                                      ret
                                                                                                                                                                                                                                                      int3
                                                                                                                                                                                                                                                      int3
                                                                                                                                                                                                                                                      inc eax
                                                                                                                                                                                                                                                      push ebx
                                                                                                                                                                                                                                                      dec eax
                                                                                                                                                                                                                                                      sub esp, 20h
                                                                                                                                                                                                                                                      cmp byte ptr [0003572Ch], 00000000h
                                                                                                                                                                                                                                                      mov ebx, ecx
                                                                                                                                                                                                                                                      jne 00007F54590C2D49h
                                                                                                                                                                                                                                                      cmp ecx, 01h
                                                                                                                                                                                                                                                      jnbe 00007F54590C2D4Ch
                                                                                                                                                                                                                                                      call 00007F54590C327Eh
                                                                                                                                                                                                                                                      test eax, eax
                                                                                                                                                                                                                                                      je 00007F54590C2D0Ah
                                                                                                                                                                                                                                                      test ebx, ebx
                                                                                                                                                                                                                                                      jne 00007F54590C2D06h
                                                                                                                                                                                                                                                      dec eax
                                                                                                                                                                                                                                                      lea ecx, dword ptr [00035716h]
                                                                                                                                                                                                                                                      call 00007F54590D0032h

                                                                                                                                                                                                                                                      Data Directories

                                                                                                                                                                                                                                                      NameVirtual AddressVirtual Size Is in Section
                                                                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_IMPORT0x3ca5c0x78.rdata
                                                                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_RESOURCE0x470000xf41c.rsrc
                                                                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_EXCEPTION0x440000x2250.pdata
                                                                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_BASERELOC0x570000x764.reloc
                                                                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_DEBUG0x3a0800x1c.rdata
                                                                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x39f400x140.rdata
                                                                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_IAT0x2b0000x4a0.rdata
                                                                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                                                                                                                                                                                                      Sections

                                                                                                                                                                                                                                                      NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                                                                                                                                                                                      .text0x10000x29f000x2a0002a7ae207b6295492e9da088072661752False0.5514439174107143data6.487454925709845IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                                                                      .rdata0x2b0000x12a500x12c0057258b1831c470607d36a5c0628eff30False0.5244661458333333data5.7526463108375125IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                                                                      .data0x3e0000x53f80xe00dba0caeecab624a0ccc0d577241601d1False0.134765625data1.8392217063172436IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                                                                                                      .pdata0x440000x22500x2400f5559f14427a02f0a5dbd0dd026cae54False0.470703125data5.291665041994019IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                                                                      .rsrc0x470000xf41c0xf600455788c285fcfdcb4008bc77e762818aFalse0.803099593495935data7.5549760623589695IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                                                                      .reloc0x570000x7640x800816c68eeb419ee2c08656c31c06a0fffFalse0.5576171875data5.2809528666624175IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                                                                                                                                                                                                                                      Resources

                                                                                                                                                                                                                                                      NameRVASizeTypeLanguageCountryZLIB Complexity
                                                                                                                                                                                                                                                      RT_ICON0x472080xea8Device independent bitmap graphic, 48 x 96 x 8, image size 00.585820895522388
                                                                                                                                                                                                                                                      RT_ICON0x480b00x8a8Device independent bitmap graphic, 32 x 64 x 8, image size 00.7360108303249098
                                                                                                                                                                                                                                                      RT_ICON0x489580x568Device independent bitmap graphic, 16 x 32 x 8, image size 00.755057803468208
                                                                                                                                                                                                                                                      RT_ICON0x48ec00x952cPNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced0.9975384937676757
                                                                                                                                                                                                                                                      RT_ICON0x523ec0x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 00.3887966804979253
                                                                                                                                                                                                                                                      RT_ICON0x549940x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 00.49530956848030017
                                                                                                                                                                                                                                                      RT_ICON0x55a3c0x468Device independent bitmap graphic, 16 x 32 x 32, image size 00.7207446808510638
                                                                                                                                                                                                                                                      RT_GROUP_ICON0x55ea40x68data0.7019230769230769
                                                                                                                                                                                                                                                      RT_MANIFEST0x55f0c0x50dXML 1.0 document, ASCII text0.4694508894044857

                                                                                                                                                                                                                                                      Imports

                                                                                                                                                                                                                                                      DLLImport
                                                                                                                                                                                                                                                      USER32.dllCreateWindowExW, ShutdownBlockReasonCreate, MsgWaitForMultipleObjects, ShowWindow, DestroyWindow, RegisterClassW, DefWindowProcW, PeekMessageW, DispatchMessageW, TranslateMessage, PostMessageW, GetMessageW, MessageBoxW, MessageBoxA, SystemParametersInfoW, DestroyIcon, SetWindowLongPtrW, GetWindowLongPtrW, GetClientRect, InvalidateRect, ReleaseDC, GetDC, DrawTextW, GetDialogBaseUnits, EndDialog, DialogBoxIndirectParamW, MoveWindow, SendMessageW
                                                                                                                                                                                                                                                      COMCTL32.dll
                                                                                                                                                                                                                                                      KERNEL32.dllGetACP, IsValidCodePage, GetStringTypeW, GetFileAttributesExW, SetEnvironmentVariableW, FlushFileBuffers, GetCurrentDirectoryW, LCMapStringW, CompareStringW, FlsFree, GetOEMCP, GetCPInfo, GetModuleHandleW, MulDiv, FormatMessageW, GetLastError, GetModuleFileNameW, LoadLibraryExW, SetDllDirectoryW, CreateSymbolicLinkW, GetProcAddress, GetEnvironmentStringsW, GetCommandLineW, GetEnvironmentVariableW, ExpandEnvironmentStringsW, DeleteFileW, FindClose, FindFirstFileW, FindNextFileW, GetDriveTypeW, RemoveDirectoryW, GetTempPathW, CloseHandle, QueryPerformanceCounter, QueryPerformanceFrequency, WaitForSingleObject, Sleep, GetCurrentProcess, TerminateProcess, GetExitCodeProcess, CreateProcessW, GetStartupInfoW, FreeLibrary, LocalFree, SetConsoleCtrlHandler, K32EnumProcessModules, K32GetModuleFileNameExW, CreateFileW, FindFirstFileExW, GetFinalPathNameByHandleW, MultiByteToWideChar, WideCharToMultiByte, FlsSetValue, FreeEnvironmentStringsW, GetProcessHeap, GetTimeZoneInformation, HeapSize, HeapReAlloc, WriteConsoleW, SetEndOfFile, CreateDirectoryW, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsProcessorFeaturePresent, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, RtlUnwindEx, SetLastError, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, EncodePointer, RaiseException, RtlPcToFileHeader, GetCommandLineA, GetFileInformationByHandle, GetFileType, PeekNamedPipe, SystemTimeToTzSpecificLocalTime, FileTimeToSystemTime, ReadFile, GetFullPathNameW, SetStdHandle, GetStdHandle, WriteFile, ExitProcess, GetModuleHandleExW, HeapFree, GetConsoleMode, ReadConsoleW, SetFilePointerEx, GetConsoleOutputCP, GetFileSizeEx, HeapAlloc, FlsAlloc, FlsGetValue
                                                                                                                                                                                                                                                      ADVAPI32.dllOpenProcessToken, GetTokenInformation, ConvertStringSecurityDescriptorToSecurityDescriptorW, ConvertSidToStringSidW
                                                                                                                                                                                                                                                      GDI32.dllSelectObject, DeleteObject, CreateFontIndirectW

                                                                                                                                                                                                                                                      Network Behavior

                                                                                                                                                                                                                                                      Network Port Distribution

                                                                                                                                                                                                                                                      TCP Packets

                                                                                                                                                                                                                                                      TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                                                                                                                      Dec 20, 2024 10:05:43.604593039 CET49736443192.168.2.4104.20.22.46
                                                                                                                                                                                                                                                      Dec 20, 2024 10:05:43.604635000 CET44349736104.20.22.46192.168.2.4
                                                                                                                                                                                                                                                      Dec 20, 2024 10:05:43.604767084 CET49736443192.168.2.4104.20.22.46
                                                                                                                                                                                                                                                      Dec 20, 2024 10:05:43.605580091 CET49736443192.168.2.4104.20.22.46
                                                                                                                                                                                                                                                      Dec 20, 2024 10:05:43.605592966 CET44349736104.20.22.46192.168.2.4
                                                                                                                                                                                                                                                      Dec 20, 2024 10:05:44.826149940 CET44349736104.20.22.46192.168.2.4
                                                                                                                                                                                                                                                      Dec 20, 2024 10:05:44.826848984 CET49736443192.168.2.4104.20.22.46
                                                                                                                                                                                                                                                      Dec 20, 2024 10:05:44.826865911 CET44349736104.20.22.46192.168.2.4
                                                                                                                                                                                                                                                      Dec 20, 2024 10:05:44.827884912 CET44349736104.20.22.46192.168.2.4
                                                                                                                                                                                                                                                      Dec 20, 2024 10:05:44.827966928 CET49736443192.168.2.4104.20.22.46
                                                                                                                                                                                                                                                      Dec 20, 2024 10:05:44.829463959 CET49736443192.168.2.4104.20.22.46
                                                                                                                                                                                                                                                      Dec 20, 2024 10:05:44.829603910 CET44349736104.20.22.46192.168.2.4
                                                                                                                                                                                                                                                      Dec 20, 2024 10:05:44.829685926 CET49736443192.168.2.4104.20.22.46
                                                                                                                                                                                                                                                      Dec 20, 2024 10:05:44.829757929 CET49736443192.168.2.4104.20.22.46

                                                                                                                                                                                                                                                      UDP Packets

                                                                                                                                                                                                                                                      TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                                                                                                                      Dec 20, 2024 10:05:43.002578020 CET5203553192.168.2.41.1.1.1
                                                                                                                                                                                                                                                      Dec 20, 2024 10:05:43.601958036 CET53520351.1.1.1192.168.2.4

                                                                                                                                                                                                                                                      DNS Queries

                                                                                                                                                                                                                                                      TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                                                                                                                                                                                                                      Dec 20, 2024 10:05:43.002578020 CET192.168.2.41.1.1.10xd597Standard query (0)nodejs.orgA (IP address)IN (0x0001)false

                                                                                                                                                                                                                                                      DNS Answers

                                                                                                                                                                                                                                                      TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                                                                                                                                                                                                                      Dec 20, 2024 10:05:43.601958036 CET1.1.1.1192.168.2.40xd597No error (0)nodejs.org104.20.22.46A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                      Dec 20, 2024 10:05:43.601958036 CET1.1.1.1192.168.2.40xd597No error (0)nodejs.org104.20.23.46A (IP address)IN (0x0001)false

                                                                                                                                                                                                                                                      Statistics

                                                                                                                                                                                                                                                      CPU Usage

                                                                                                                                                                                                                                                      Click to jump to process

                                                                                                                                                                                                                                                      Memory Usage

                                                                                                                                                                                                                                                      Click to jump to process

                                                                                                                                                                                                                                                      High Level Behavior Distribution

                                                                                                                                                                                                                                                      Click to dive into process behavior distribution

                                                                                                                                                                                                                                                      Behavior

                                                                                                                                                                                                                                                      Click to jump to process

                                                                                                                                                                                                                                                      System Behavior

                                                                                                                                                                                                                                                      General

                                                                                                                                                                                                                                                      Target ID:0
                                                                                                                                                                                                                                                      Start time:04:05:23
                                                                                                                                                                                                                                                      Start date:20/12/2024
                                                                                                                                                                                                                                                      Path:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                                                                      Commandline:"C:\Users\user\Desktop\wp-s2.exe"
                                                                                                                                                                                                                                                      Imagebase:0x7ff705670000
                                                                                                                                                                                                                                                      File size:38'752'565 bytes
                                                                                                                                                                                                                                                      MD5 hash:62370A84134040D803EAE9A4BD34342C
                                                                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                                                                                      General

                                                                                                                                                                                                                                                      Target ID:1
                                                                                                                                                                                                                                                      Start time:04:05:30
                                                                                                                                                                                                                                                      Start date:20/12/2024
                                                                                                                                                                                                                                                      Path:C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                                                                      Commandline:"C:\Users\user\Desktop\wp-s2.exe"
                                                                                                                                                                                                                                                      Imagebase:0x7ff705670000
                                                                                                                                                                                                                                                      File size:38'752'565 bytes
                                                                                                                                                                                                                                                      MD5 hash:62370A84134040D803EAE9A4BD34342C
                                                                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                      Yara matches:
                                                                                                                                                                                                                                                      • Rule: JoeSecurity_PythonBackDoor_1, Description: Yara detected Python BackDoor, Source: 00000001.00000003.1813063325.000001F10684D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                                      • Rule: JoeSecurity_PythonBackDoor_1, Description: Yara detected Python BackDoor, Source: 00000001.00000003.1813329985.000001F10682F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                                      • Rule: JoeSecurity_PythonBackDoor_1, Description: Yara detected Python BackDoor, Source: 00000001.00000002.2480246518.000001F10682F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                                                                                      General

                                                                                                                                                                                                                                                      Target ID:3
                                                                                                                                                                                                                                                      Start time:04:05:40
                                                                                                                                                                                                                                                      Start date:20/12/2024
                                                                                                                                                                                                                                                      Path:C:\Windows\System32\systeminfo.exe
                                                                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                                                                      Commandline:systeminfo
                                                                                                                                                                                                                                                      Imagebase:0x7ff6ac5c0000
                                                                                                                                                                                                                                                      File size:110'080 bytes
                                                                                                                                                                                                                                                      MD5 hash:EE309A9C61511E907D87B10EF226FDCD
                                                                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                      Reputation:moderate
                                                                                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                                                                                      General

                                                                                                                                                                                                                                                      Target ID:4
                                                                                                                                                                                                                                                      Start time:04:05:40
                                                                                                                                                                                                                                                      Start date:20/12/2024
                                                                                                                                                                                                                                                      Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                      Imagebase:0x7ff7699e0000
                                                                                                                                                                                                                                                      File size:862'208 bytes
                                                                                                                                                                                                                                                      MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                      Reputation:high
                                                                                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                                                                                      General

                                                                                                                                                                                                                                                      Target ID:7
                                                                                                                                                                                                                                                      Start time:04:05:40
                                                                                                                                                                                                                                                      Start date:20/12/2024
                                                                                                                                                                                                                                                      Path:C:\Windows\System32\wbem\WmiPrvSE.exe
                                                                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                                                                      Commandline:C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
                                                                                                                                                                                                                                                      Imagebase:0x7ff693ab0000
                                                                                                                                                                                                                                                      File size:496'640 bytes
                                                                                                                                                                                                                                                      MD5 hash:60FF40CFD7FB8FE41EE4FE9AE5FE1C51
                                                                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                                                                      Has administrator privileges:false
                                                                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                      Reputation:high
                                                                                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                                                                                      General

                                                                                                                                                                                                                                                      Target ID:8
                                                                                                                                                                                                                                                      Start time:04:05:40
                                                                                                                                                                                                                                                      Start date:20/12/2024
                                                                                                                                                                                                                                                      Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                                                                      Commandline:C:\Windows\system32\cmd.exe /c "wmic computersystem get manufacturer"
                                                                                                                                                                                                                                                      Imagebase:0x7ff75daa0000
                                                                                                                                                                                                                                                      File size:289'792 bytes
                                                                                                                                                                                                                                                      MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                      Reputation:high
                                                                                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                                                                                      General

                                                                                                                                                                                                                                                      Target ID:9
                                                                                                                                                                                                                                                      Start time:04:05:40
                                                                                                                                                                                                                                                      Start date:20/12/2024
                                                                                                                                                                                                                                                      Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                      Imagebase:0x7ff7699e0000
                                                                                                                                                                                                                                                      File size:862'208 bytes
                                                                                                                                                                                                                                                      MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                      Reputation:high
                                                                                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                                                                                      General

                                                                                                                                                                                                                                                      Target ID:10
                                                                                                                                                                                                                                                      Start time:04:05:40
                                                                                                                                                                                                                                                      Start date:20/12/2024
                                                                                                                                                                                                                                                      Path:C:\Windows\System32\wbem\WMIC.exe
                                                                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                                                                      Commandline:wmic computersystem get manufacturer
                                                                                                                                                                                                                                                      Imagebase:0x7ff74c840000
                                                                                                                                                                                                                                                      File size:576'000 bytes
                                                                                                                                                                                                                                                      MD5 hash:C37F2F4F4B3CD128BDABCAEB2266A785
                                                                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                      Reputation:high
                                                                                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                                                                                      General

                                                                                                                                                                                                                                                      Target ID:13
                                                                                                                                                                                                                                                      Start time:04:05:46
                                                                                                                                                                                                                                                      Start date:20/12/2024
                                                                                                                                                                                                                                                      Path:C:\Windows\System32\WerFault.exe
                                                                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                                                                      Commandline:C:\Windows\system32\WerFault.exe -u -p 7308 -s 984
                                                                                                                                                                                                                                                      Imagebase:0x7ff7606e0000
                                                                                                                                                                                                                                                      File size:570'736 bytes
                                                                                                                                                                                                                                                      MD5 hash:FD27D9F6D02763BDE32511B5DF7FF7A0
                                                                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                      Reputation:high
                                                                                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                                                                                      Disassembly

                                                                                                                                                                                                                                                      Reset < >

                                                                                                                                                                                                                                                        Execution Graph

                                                                                                                                                                                                                                                        Execution Coverage:10.3%
                                                                                                                                                                                                                                                        Dynamic/Decrypted Code Coverage:0%
                                                                                                                                                                                                                                                        Signature Coverage:20.1%
                                                                                                                                                                                                                                                        Total number of Nodes:2000
                                                                                                                                                                                                                                                        Total number of Limit Nodes:59
                                                                                                                                                                                                                                                        execution_graph 19514 7ff70568f98c 19515 7ff70568fb7e 19514->19515 19519 7ff70568f9ce _isindst 19514->19519 19516 7ff705684f08 _set_fmode 11 API calls 19515->19516 19534 7ff70568fb6e 19516->19534 19517 7ff70567c550 _log10_special 8 API calls 19518 7ff70568fb99 19517->19518 19519->19515 19520 7ff70568fa4e _isindst 19519->19520 19535 7ff705696194 19520->19535 19525 7ff70568fbaa 19527 7ff70568a900 _isindst 17 API calls 19525->19527 19529 7ff70568fbbe 19527->19529 19532 7ff70568faab 19532->19534 19560 7ff7056961d8 19532->19560 19534->19517 19536 7ff70568fa6c 19535->19536 19537 7ff7056961a3 19535->19537 19542 7ff705695598 19536->19542 19567 7ff7056902d8 EnterCriticalSection 19537->19567 19543 7ff7056955a1 19542->19543 19547 7ff70568fa81 19542->19547 19544 7ff705684f08 _set_fmode 11 API calls 19543->19544 19545 7ff7056955a6 19544->19545 19546 7ff70568a8e0 _invalid_parameter_noinfo 37 API calls 19545->19546 19546->19547 19547->19525 19548 7ff7056955c8 19547->19548 19549 7ff7056955d1 19548->19549 19550 7ff70568fa92 19548->19550 19551 7ff705684f08 _set_fmode 11 API calls 19549->19551 19550->19525 19554 7ff7056955f8 19550->19554 19552 7ff7056955d6 19551->19552 19553 7ff70568a8e0 _invalid_parameter_noinfo 37 API calls 19552->19553 19553->19550 19555 7ff705695601 19554->19555 19556 7ff70568faa3 19554->19556 19557 7ff705684f08 _set_fmode 11 API calls 19555->19557 19556->19525 19556->19532 19558 7ff705695606 19557->19558 19559 7ff70568a8e0 _invalid_parameter_noinfo 37 API calls 19558->19559 19559->19556 19568 7ff7056902d8 EnterCriticalSection 19560->19568 20471 7ff705685410 20472 7ff70568541b 20471->20472 20480 7ff70568f2a4 20472->20480 20493 7ff7056902d8 EnterCriticalSection 20480->20493 20494 7ff70569adfe 20495 7ff70569ae17 20494->20495 20496 7ff70569ae0d 20494->20496 20498 7ff705690338 LeaveCriticalSection 20496->20498 20272 7ff70569ad69 20275 7ff705685478 LeaveCriticalSection 20272->20275 18720 7ff705689961 18721 7ff70568a3d8 45 API calls 18720->18721 18722 7ff705689966 18721->18722 18723 7ff7056899d7 18722->18723 18724 7ff70568998d GetModuleHandleW 18722->18724 18732 7ff705689864 18723->18732 18724->18723 18730 7ff70568999a 18724->18730 18730->18723 18746 7ff705689a88 GetModuleHandleExW 18730->18746 18752 7ff7056902d8 EnterCriticalSection 18732->18752 18747 7ff705689ae5 18746->18747 18748 7ff705689abc GetProcAddress 18746->18748 18750 7ff705689af1 18747->18750 18751 7ff705689aea FreeLibrary 18747->18751 18749 7ff705689ace 18748->18749 18749->18747 18750->18723 18751->18750 20500 7ff70569abe3 20501 7ff70569abf3 20500->20501 20504 7ff705685478 LeaveCriticalSection 20501->20504 19569 7ff70567bae0 19570 7ff70567bb0e 19569->19570 19571 7ff70567baf5 19569->19571 19571->19570 19573 7ff70568d5fc 12 API calls 19571->19573 19572 7ff70567bb6e 19573->19572 20315 7ff705689d50 20318 7ff705689ccc 20315->20318 20325 7ff7056902d8 EnterCriticalSection 20318->20325 20573 7ff70568afd0 20574 7ff70568afea 20573->20574 20575 7ff70568afd5 20573->20575 20579 7ff70568aff0 20575->20579 20580 7ff70568b032 20579->20580 20581 7ff70568b03a 20579->20581 20583 7ff70568a948 __free_lconv_num 11 API calls 20580->20583 20582 7ff70568a948 __free_lconv_num 11 API calls 20581->20582 20584 7ff70568b047 20582->20584 20583->20581 20585 7ff70568a948 __free_lconv_num 11 API calls 20584->20585 20586 7ff70568b054 20585->20586 20587 7ff70568a948 __free_lconv_num 11 API calls 20586->20587 20588 7ff70568b061 20587->20588 20589 7ff70568a948 __free_lconv_num 11 API calls 20588->20589 20590 7ff70568b06e 20589->20590 20591 7ff70568a948 __free_lconv_num 11 API calls 20590->20591 20592 7ff70568b07b 20591->20592 20593 7ff70568a948 __free_lconv_num 11 API calls 20592->20593 20594 7ff70568b088 20593->20594 20595 7ff70568a948 __free_lconv_num 11 API calls 20594->20595 20596 7ff70568b095 20595->20596 20597 7ff70568a948 __free_lconv_num 11 API calls 20596->20597 20598 7ff70568b0a5 20597->20598 20599 7ff70568a948 __free_lconv_num 11 API calls 20598->20599 20600 7ff70568b0b5 20599->20600 20605 7ff70568ae94 20600->20605 20619 7ff7056902d8 EnterCriticalSection 20605->20619 18886 7ff7056908c8 18887 7ff7056908ec 18886->18887 18889 7ff7056908fc 18886->18889 18888 7ff705684f08 _set_fmode 11 API calls 18887->18888 18911 7ff7056908f1 18888->18911 18890 7ff705690bdc 18889->18890 18891 7ff70569091e 18889->18891 18892 7ff705684f08 _set_fmode 11 API calls 18890->18892 18893 7ff70569093f 18891->18893 19017 7ff705690f84 18891->19017 18894 7ff705690be1 18892->18894 18897 7ff7056909b1 18893->18897 18898 7ff705690965 18893->18898 18903 7ff7056909a5 18893->18903 18896 7ff70568a948 __free_lconv_num 11 API calls 18894->18896 18896->18911 18900 7ff70568eb98 _set_fmode 11 API calls 18897->18900 18915 7ff705690974 18897->18915 19032 7ff7056896c0 18898->19032 18899 7ff705690a5e 18910 7ff705690a7b 18899->18910 18916 7ff705690acd 18899->18916 18904 7ff7056909c7 18900->18904 18903->18899 18903->18915 19038 7ff70569712c 18903->19038 18907 7ff70568a948 __free_lconv_num 11 API calls 18904->18907 18906 7ff70568a948 __free_lconv_num 11 API calls 18906->18911 18912 7ff7056909d5 18907->18912 18908 7ff70569096f 18913 7ff705684f08 _set_fmode 11 API calls 18908->18913 18909 7ff70569098d 18909->18903 18918 7ff705690f84 45 API calls 18909->18918 18914 7ff70568a948 __free_lconv_num 11 API calls 18910->18914 18912->18903 18912->18915 18920 7ff70568eb98 _set_fmode 11 API calls 18912->18920 18913->18915 18917 7ff705690a84 18914->18917 18915->18906 18916->18915 18919 7ff7056933dc 40 API calls 18916->18919 18926 7ff705690a89 18917->18926 19074 7ff7056933dc 18917->19074 18918->18903 18921 7ff705690b0a 18919->18921 18922 7ff7056909f7 18920->18922 18923 7ff70568a948 __free_lconv_num 11 API calls 18921->18923 18928 7ff70568a948 __free_lconv_num 11 API calls 18922->18928 18929 7ff705690b14 18923->18929 18925 7ff705690bd0 18931 7ff70568a948 __free_lconv_num 11 API calls 18925->18931 18926->18925 18932 7ff70568eb98 _set_fmode 11 API calls 18926->18932 18927 7ff705690ab5 18930 7ff70568a948 __free_lconv_num 11 API calls 18927->18930 18928->18903 18929->18915 18929->18926 18930->18926 18931->18911 18933 7ff705690b58 18932->18933 18934 7ff705690b60 18933->18934 18935 7ff705690b69 18933->18935 18936 7ff70568a948 __free_lconv_num 11 API calls 18934->18936 18937 7ff70568a4a4 __std_exception_copy 37 API calls 18935->18937 18938 7ff705690b67 18936->18938 18939 7ff705690b78 18937->18939 18943 7ff70568a948 __free_lconv_num 11 API calls 18938->18943 18940 7ff705690b80 18939->18940 18941 7ff705690c0b 18939->18941 19083 7ff705697244 18940->19083 18942 7ff70568a900 _isindst 17 API calls 18941->18942 18945 7ff705690c1f 18942->18945 18943->18911 18947 7ff705690c48 18945->18947 18955 7ff705690c58 18945->18955 18950 7ff705684f08 _set_fmode 11 API calls 18947->18950 18948 7ff705690ba7 18952 7ff705684f08 _set_fmode 11 API calls 18948->18952 18949 7ff705690bc8 18951 7ff70568a948 __free_lconv_num 11 API calls 18949->18951 18979 7ff705690c4d 18950->18979 18951->18925 18953 7ff705690bac 18952->18953 18954 7ff70568a948 __free_lconv_num 11 API calls 18953->18954 18954->18938 18956 7ff705690f3b 18955->18956 18957 7ff705690c7a 18955->18957 18958 7ff705684f08 _set_fmode 11 API calls 18956->18958 18959 7ff705690c97 18957->18959 19102 7ff70569106c 18957->19102 18960 7ff705690f40 18958->18960 18963 7ff705690d0b 18959->18963 18965 7ff705690cbf 18959->18965 18969 7ff705690cff 18959->18969 18962 7ff70568a948 __free_lconv_num 11 API calls 18960->18962 18962->18979 18967 7ff705690d33 18963->18967 18970 7ff70568eb98 _set_fmode 11 API calls 18963->18970 18984 7ff705690cce 18963->18984 18964 7ff705690dbe 18978 7ff705690ddb 18964->18978 18985 7ff705690e2e 18964->18985 19117 7ff7056896fc 18965->19117 18967->18969 18972 7ff70568eb98 _set_fmode 11 API calls 18967->18972 18967->18984 18969->18964 18969->18984 19123 7ff705696fec 18969->19123 18974 7ff705690d25 18970->18974 18977 7ff705690d55 18972->18977 18973 7ff70568a948 __free_lconv_num 11 API calls 18973->18979 18980 7ff70568a948 __free_lconv_num 11 API calls 18974->18980 18975 7ff705690ce7 18975->18969 18987 7ff70569106c 45 API calls 18975->18987 18976 7ff705690cc9 18981 7ff705684f08 _set_fmode 11 API calls 18976->18981 18982 7ff70568a948 __free_lconv_num 11 API calls 18977->18982 18983 7ff70568a948 __free_lconv_num 11 API calls 18978->18983 18980->18967 18981->18984 18982->18969 18986 7ff705690de4 18983->18986 18984->18973 18985->18984 18988 7ff7056933dc 40 API calls 18985->18988 18990 7ff7056933dc 40 API calls 18986->18990 18994 7ff705690dea 18986->18994 18987->18969 18989 7ff705690e6c 18988->18989 18991 7ff70568a948 __free_lconv_num 11 API calls 18989->18991 18992 7ff705690e16 18990->18992 18995 7ff705690e76 18991->18995 18996 7ff70568a948 __free_lconv_num 11 API calls 18992->18996 18993 7ff705690f2f 18997 7ff70568a948 __free_lconv_num 11 API calls 18993->18997 18994->18993 18998 7ff70568eb98 _set_fmode 11 API calls 18994->18998 18995->18984 18995->18994 18996->18994 18997->18979 18999 7ff705690ebb 18998->18999 19000 7ff705690ec3 18999->19000 19001 7ff705690ecc 18999->19001 19002 7ff70568a948 __free_lconv_num 11 API calls 19000->19002 19003 7ff705690474 37 API calls 19001->19003 19004 7ff705690eca 19002->19004 19005 7ff705690eda 19003->19005 19009 7ff70568a948 __free_lconv_num 11 API calls 19004->19009 19006 7ff705690f6f 19005->19006 19007 7ff705690ee2 SetEnvironmentVariableW 19005->19007 19008 7ff70568a900 _isindst 17 API calls 19006->19008 19010 7ff705690f06 19007->19010 19011 7ff705690f27 19007->19011 19012 7ff705690f83 19008->19012 19009->18979 19014 7ff705684f08 _set_fmode 11 API calls 19010->19014 19013 7ff70568a948 __free_lconv_num 11 API calls 19011->19013 19013->18993 19015 7ff705690f0b 19014->19015 19016 7ff70568a948 __free_lconv_num 11 API calls 19015->19016 19016->19004 19018 7ff705690fb9 19017->19018 19024 7ff705690fa1 19017->19024 19019 7ff70568eb98 _set_fmode 11 API calls 19018->19019 19027 7ff705690fdd 19019->19027 19020 7ff70569103e 19023 7ff70568a948 __free_lconv_num 11 API calls 19020->19023 19021 7ff70568a504 __CxxCallCatchBlock 45 API calls 19022 7ff705691068 19021->19022 19023->19024 19024->18893 19025 7ff70568eb98 _set_fmode 11 API calls 19025->19027 19026 7ff70568a948 __free_lconv_num 11 API calls 19026->19027 19027->19020 19027->19025 19027->19026 19028 7ff70568a4a4 __std_exception_copy 37 API calls 19027->19028 19029 7ff70569104d 19027->19029 19031 7ff705691062 19027->19031 19028->19027 19030 7ff70568a900 _isindst 17 API calls 19029->19030 19030->19031 19031->19021 19033 7ff7056896d0 19032->19033 19037 7ff7056896d9 19032->19037 19033->19037 19147 7ff705689198 19033->19147 19037->18908 19037->18909 19039 7ff705696254 19038->19039 19040 7ff705697139 19038->19040 19041 7ff705696261 19039->19041 19048 7ff705696297 19039->19048 19042 7ff705684f4c 45 API calls 19040->19042 19045 7ff705684f08 _set_fmode 11 API calls 19041->19045 19058 7ff705696208 19041->19058 19044 7ff70569716d 19042->19044 19043 7ff7056962c1 19046 7ff705684f08 _set_fmode 11 API calls 19043->19046 19047 7ff705697172 19044->19047 19051 7ff705697183 19044->19051 19055 7ff70569719a 19044->19055 19049 7ff70569626b 19045->19049 19050 7ff7056962c6 19046->19050 19047->18903 19048->19043 19052 7ff7056962e6 19048->19052 19053 7ff70568a8e0 _invalid_parameter_noinfo 37 API calls 19049->19053 19054 7ff70568a8e0 _invalid_parameter_noinfo 37 API calls 19050->19054 19056 7ff705684f08 _set_fmode 11 API calls 19051->19056 19060 7ff705684f4c 45 API calls 19052->19060 19066 7ff7056962d1 19052->19066 19057 7ff705696276 19053->19057 19054->19066 19061 7ff7056971a4 19055->19061 19062 7ff7056971b6 19055->19062 19059 7ff705697188 19056->19059 19057->18903 19058->18903 19065 7ff70568a8e0 _invalid_parameter_noinfo 37 API calls 19059->19065 19060->19066 19067 7ff705684f08 _set_fmode 11 API calls 19061->19067 19063 7ff7056971c7 19062->19063 19064 7ff7056971de 19062->19064 19370 7ff7056962a4 19063->19370 19379 7ff705698f4c 19064->19379 19065->19047 19066->18903 19068 7ff7056971a9 19067->19068 19071 7ff70568a8e0 _invalid_parameter_noinfo 37 API calls 19068->19071 19071->19047 19073 7ff705684f08 _set_fmode 11 API calls 19073->19047 19075 7ff70569341b 19074->19075 19076 7ff7056933fe 19074->19076 19077 7ff705693425 19075->19077 19419 7ff705697c38 19075->19419 19076->19075 19078 7ff70569340c 19076->19078 19426 7ff705697c74 19077->19426 19080 7ff705684f08 _set_fmode 11 API calls 19078->19080 19081 7ff705693411 __scrt_get_show_window_mode 19080->19081 19081->18927 19084 7ff705684f4c 45 API calls 19083->19084 19085 7ff7056972aa 19084->19085 19086 7ff7056972b8 19085->19086 19438 7ff70568ef24 19085->19438 19441 7ff7056854ac 19086->19441 19090 7ff7056973a4 19093 7ff7056973b5 19090->19093 19094 7ff70568a948 __free_lconv_num 11 API calls 19090->19094 19091 7ff705684f4c 45 API calls 19092 7ff705697327 19091->19092 19096 7ff70568ef24 5 API calls 19092->19096 19099 7ff705697330 19092->19099 19095 7ff705690ba3 19093->19095 19097 7ff70568a948 __free_lconv_num 11 API calls 19093->19097 19094->19093 19095->18948 19095->18949 19096->19099 19097->19095 19098 7ff7056854ac 14 API calls 19100 7ff70569738b 19098->19100 19099->19098 19100->19090 19101 7ff705697393 SetEnvironmentVariableW 19100->19101 19101->19090 19103 7ff7056910ac 19102->19103 19110 7ff70569108f 19102->19110 19104 7ff70568eb98 _set_fmode 11 API calls 19103->19104 19112 7ff7056910d0 19104->19112 19105 7ff705691154 19107 7ff70568a504 __CxxCallCatchBlock 45 API calls 19105->19107 19106 7ff705691131 19108 7ff70568a948 __free_lconv_num 11 API calls 19106->19108 19109 7ff70569115a 19107->19109 19108->19110 19110->18959 19111 7ff70568eb98 _set_fmode 11 API calls 19111->19112 19112->19105 19112->19106 19112->19111 19113 7ff70568a948 __free_lconv_num 11 API calls 19112->19113 19114 7ff705690474 37 API calls 19112->19114 19115 7ff705691140 19112->19115 19113->19112 19114->19112 19116 7ff70568a900 _isindst 17 API calls 19115->19116 19116->19105 19118 7ff705689715 19117->19118 19119 7ff70568970c 19117->19119 19118->18975 19118->18976 19119->19118 19463 7ff70568920c 19119->19463 19126 7ff705696ff9 19123->19126 19128 7ff705697026 19123->19128 19124 7ff705696ffe 19125 7ff705684f08 _set_fmode 11 API calls 19124->19125 19127 7ff705697003 19125->19127 19126->19124 19126->19128 19130 7ff70568a8e0 _invalid_parameter_noinfo 37 API calls 19127->19130 19129 7ff70569706a 19128->19129 19131 7ff705697089 19128->19131 19145 7ff70569705e __crtLCMapStringW 19128->19145 19132 7ff705684f08 _set_fmode 11 API calls 19129->19132 19133 7ff70569700e 19130->19133 19134 7ff705697093 19131->19134 19135 7ff7056970a5 19131->19135 19136 7ff70569706f 19132->19136 19133->18969 19138 7ff705684f08 _set_fmode 11 API calls 19134->19138 19139 7ff705684f4c 45 API calls 19135->19139 19137 7ff70568a8e0 _invalid_parameter_noinfo 37 API calls 19136->19137 19137->19145 19140 7ff705697098 19138->19140 19141 7ff7056970b2 19139->19141 19142 7ff70568a8e0 _invalid_parameter_noinfo 37 API calls 19140->19142 19141->19145 19510 7ff705698b08 19141->19510 19142->19145 19145->18969 19146 7ff705684f08 _set_fmode 11 API calls 19146->19145 19148 7ff7056891b1 19147->19148 19149 7ff7056891ad 19147->19149 19170 7ff7056925f0 19148->19170 19149->19037 19162 7ff7056894ec 19149->19162 19154 7ff7056891cf 19196 7ff70568927c 19154->19196 19155 7ff7056891c3 19156 7ff70568a948 __free_lconv_num 11 API calls 19155->19156 19156->19149 19159 7ff70568a948 __free_lconv_num 11 API calls 19160 7ff7056891f6 19159->19160 19161 7ff70568a948 __free_lconv_num 11 API calls 19160->19161 19161->19149 19163 7ff705689515 19162->19163 19166 7ff70568952e 19162->19166 19163->19037 19164 7ff7056907e8 WideCharToMultiByte 19164->19166 19165 7ff70568eb98 _set_fmode 11 API calls 19165->19166 19166->19163 19166->19164 19166->19165 19167 7ff7056895be 19166->19167 19169 7ff70568a948 __free_lconv_num 11 API calls 19166->19169 19168 7ff70568a948 __free_lconv_num 11 API calls 19167->19168 19168->19163 19169->19166 19171 7ff7056925fd 19170->19171 19175 7ff7056891b6 19170->19175 19215 7ff70568b224 19171->19215 19176 7ff70569292c GetEnvironmentStringsW 19175->19176 19177 7ff7056891bb 19176->19177 19179 7ff70569295c 19176->19179 19177->19154 19177->19155 19178 7ff7056907e8 WideCharToMultiByte 19180 7ff7056929ad 19178->19180 19179->19178 19181 7ff7056929b4 FreeEnvironmentStringsW 19180->19181 19182 7ff70568d5fc _fread_nolock 12 API calls 19180->19182 19181->19177 19183 7ff7056929c7 19182->19183 19184 7ff7056929cf 19183->19184 19185 7ff7056929d8 19183->19185 19186 7ff70568a948 __free_lconv_num 11 API calls 19184->19186 19187 7ff7056907e8 WideCharToMultiByte 19185->19187 19188 7ff7056929d6 19186->19188 19189 7ff7056929fb 19187->19189 19188->19181 19190 7ff7056929ff 19189->19190 19191 7ff705692a09 19189->19191 19192 7ff70568a948 __free_lconv_num 11 API calls 19190->19192 19193 7ff70568a948 __free_lconv_num 11 API calls 19191->19193 19194 7ff705692a07 FreeEnvironmentStringsW 19192->19194 19193->19194 19194->19177 19197 7ff7056892a1 19196->19197 19198 7ff70568eb98 _set_fmode 11 API calls 19197->19198 19207 7ff7056892d7 19198->19207 19199 7ff70568a948 __free_lconv_num 11 API calls 19200 7ff7056891d7 19199->19200 19200->19159 19201 7ff705689352 19202 7ff70568a948 __free_lconv_num 11 API calls 19201->19202 19202->19200 19203 7ff70568eb98 _set_fmode 11 API calls 19203->19207 19204 7ff705689341 19364 7ff7056894a8 19204->19364 19205 7ff70568a4a4 __std_exception_copy 37 API calls 19205->19207 19207->19201 19207->19203 19207->19204 19207->19205 19209 7ff705689377 19207->19209 19212 7ff70568a948 __free_lconv_num 11 API calls 19207->19212 19213 7ff7056892df 19207->19213 19211 7ff70568a900 _isindst 17 API calls 19209->19211 19210 7ff70568a948 __free_lconv_num 11 API calls 19210->19213 19214 7ff70568938a 19211->19214 19212->19207 19213->19199 19216 7ff70568b250 FlsSetValue 19215->19216 19217 7ff70568b235 FlsGetValue 19215->19217 19218 7ff70568b242 19216->19218 19219 7ff70568b25d 19216->19219 19217->19218 19220 7ff70568b24a 19217->19220 19221 7ff70568a504 __CxxCallCatchBlock 45 API calls 19218->19221 19225 7ff70568b248 19218->19225 19222 7ff70568eb98 _set_fmode 11 API calls 19219->19222 19220->19216 19223 7ff70568b2c5 19221->19223 19224 7ff70568b26c 19222->19224 19226 7ff70568b28a FlsSetValue 19224->19226 19227 7ff70568b27a FlsSetValue 19224->19227 19235 7ff7056922c4 19225->19235 19229 7ff70568b296 FlsSetValue 19226->19229 19230 7ff70568b2a8 19226->19230 19228 7ff70568b283 19227->19228 19231 7ff70568a948 __free_lconv_num 11 API calls 19228->19231 19229->19228 19232 7ff70568aef4 _set_fmode 11 API calls 19230->19232 19231->19218 19233 7ff70568b2b0 19232->19233 19234 7ff70568a948 __free_lconv_num 11 API calls 19233->19234 19234->19225 19258 7ff705692534 19235->19258 19237 7ff7056922f9 19273 7ff705691fc4 19237->19273 19240 7ff705692316 19240->19175 19241 7ff70568d5fc _fread_nolock 12 API calls 19242 7ff705692327 19241->19242 19243 7ff70569232f 19242->19243 19245 7ff70569233e 19242->19245 19244 7ff70568a948 __free_lconv_num 11 API calls 19243->19244 19244->19240 19245->19245 19280 7ff70569266c 19245->19280 19248 7ff70569243a 19249 7ff705684f08 _set_fmode 11 API calls 19248->19249 19250 7ff70569243f 19249->19250 19252 7ff70568a948 __free_lconv_num 11 API calls 19250->19252 19251 7ff705692495 19254 7ff7056924fc 19251->19254 19291 7ff705691df4 19251->19291 19252->19240 19253 7ff705692454 19253->19251 19256 7ff70568a948 __free_lconv_num 11 API calls 19253->19256 19255 7ff70568a948 __free_lconv_num 11 API calls 19254->19255 19255->19240 19256->19251 19259 7ff705692557 19258->19259 19261 7ff705692561 19259->19261 19306 7ff7056902d8 EnterCriticalSection 19259->19306 19263 7ff7056925d3 19261->19263 19265 7ff70568a504 __CxxCallCatchBlock 45 API calls 19261->19265 19263->19237 19267 7ff7056925eb 19265->19267 19269 7ff70568b224 50 API calls 19267->19269 19272 7ff705692642 19267->19272 19270 7ff70569262c 19269->19270 19271 7ff7056922c4 65 API calls 19270->19271 19271->19272 19272->19237 19274 7ff705684f4c 45 API calls 19273->19274 19275 7ff705691fd8 19274->19275 19276 7ff705691fe4 GetOEMCP 19275->19276 19277 7ff705691ff6 19275->19277 19278 7ff70569200b 19276->19278 19277->19278 19279 7ff705691ffb GetACP 19277->19279 19278->19240 19278->19241 19279->19278 19281 7ff705691fc4 47 API calls 19280->19281 19282 7ff705692699 19281->19282 19283 7ff7056927ef 19282->19283 19284 7ff7056926d6 IsValidCodePage 19282->19284 19290 7ff7056926f0 __scrt_get_show_window_mode 19282->19290 19285 7ff70567c550 _log10_special 8 API calls 19283->19285 19284->19283 19286 7ff7056926e7 19284->19286 19287 7ff705692431 19285->19287 19288 7ff705692716 GetCPInfo 19286->19288 19286->19290 19287->19248 19287->19253 19288->19283 19288->19290 19307 7ff7056920dc 19290->19307 19363 7ff7056902d8 EnterCriticalSection 19291->19363 19308 7ff705692119 GetCPInfo 19307->19308 19309 7ff70569220f 19307->19309 19308->19309 19314 7ff70569212c 19308->19314 19310 7ff70567c550 _log10_special 8 API calls 19309->19310 19311 7ff7056922ae 19310->19311 19311->19283 19312 7ff705692e40 48 API calls 19313 7ff7056921a3 19312->19313 19318 7ff705697b84 19313->19318 19314->19312 19317 7ff705697b84 54 API calls 19317->19309 19319 7ff705684f4c 45 API calls 19318->19319 19320 7ff705697ba9 19319->19320 19323 7ff705697850 19320->19323 19324 7ff705697891 19323->19324 19325 7ff70568f8a0 _fread_nolock MultiByteToWideChar 19324->19325 19328 7ff7056978db 19325->19328 19326 7ff705697b59 19327 7ff70567c550 _log10_special 8 API calls 19326->19327 19329 7ff7056921d6 19327->19329 19328->19326 19330 7ff70568d5fc _fread_nolock 12 API calls 19328->19330 19331 7ff705697a11 19328->19331 19333 7ff705697913 19328->19333 19329->19317 19330->19333 19331->19326 19332 7ff70568a948 __free_lconv_num 11 API calls 19331->19332 19332->19326 19333->19331 19334 7ff70568f8a0 _fread_nolock MultiByteToWideChar 19333->19334 19335 7ff705697986 19334->19335 19335->19331 19354 7ff70568f0e4 19335->19354 19338 7ff7056979d1 19338->19331 19341 7ff70568f0e4 __crtLCMapStringW 6 API calls 19338->19341 19339 7ff705697a22 19340 7ff70568d5fc _fread_nolock 12 API calls 19339->19340 19342 7ff705697af4 19339->19342 19344 7ff705697a40 19339->19344 19340->19344 19341->19331 19342->19331 19343 7ff70568a948 __free_lconv_num 11 API calls 19342->19343 19343->19331 19344->19331 19345 7ff70568f0e4 __crtLCMapStringW 6 API calls 19344->19345 19346 7ff705697ac0 19345->19346 19346->19342 19347 7ff705697ae0 19346->19347 19348 7ff705697af6 19346->19348 19349 7ff7056907e8 WideCharToMultiByte 19347->19349 19350 7ff7056907e8 WideCharToMultiByte 19348->19350 19351 7ff705697aee 19349->19351 19350->19351 19351->19342 19352 7ff705697b0e 19351->19352 19352->19331 19353 7ff70568a948 __free_lconv_num 11 API calls 19352->19353 19353->19331 19355 7ff70568ed10 __crtLCMapStringW 5 API calls 19354->19355 19356 7ff70568f122 19355->19356 19357 7ff70568f12a 19356->19357 19360 7ff70568f1d0 19356->19360 19357->19331 19357->19338 19357->19339 19359 7ff70568f193 LCMapStringW 19359->19357 19361 7ff70568ed10 __crtLCMapStringW 5 API calls 19360->19361 19362 7ff70568f1fe __crtLCMapStringW 19361->19362 19362->19359 19368 7ff7056894ad 19364->19368 19369 7ff705689349 19364->19369 19365 7ff7056894d6 19367 7ff70568a948 __free_lconv_num 11 API calls 19365->19367 19366 7ff70568a948 __free_lconv_num 11 API calls 19366->19368 19367->19369 19368->19365 19368->19366 19369->19210 19371 7ff7056962c1 19370->19371 19372 7ff7056962d8 19370->19372 19373 7ff705684f08 _set_fmode 11 API calls 19371->19373 19372->19371 19375 7ff7056962e6 19372->19375 19374 7ff7056962c6 19373->19374 19376 7ff70568a8e0 _invalid_parameter_noinfo 37 API calls 19374->19376 19377 7ff705684f4c 45 API calls 19375->19377 19378 7ff7056962d1 19375->19378 19376->19378 19377->19378 19378->19047 19380 7ff705684f4c 45 API calls 19379->19380 19381 7ff705698f71 19380->19381 19384 7ff705698bc8 19381->19384 19386 7ff705698c16 19384->19386 19385 7ff70567c550 _log10_special 8 API calls 19387 7ff705697205 19385->19387 19388 7ff705698c9d 19386->19388 19390 7ff705698c88 GetCPInfo 19386->19390 19392 7ff705698ca1 19386->19392 19387->19047 19387->19073 19389 7ff70568f8a0 _fread_nolock MultiByteToWideChar 19388->19389 19388->19392 19391 7ff705698d35 19389->19391 19390->19388 19390->19392 19391->19392 19393 7ff70568d5fc _fread_nolock 12 API calls 19391->19393 19394 7ff705698d6c 19391->19394 19392->19385 19393->19394 19394->19392 19395 7ff70568f8a0 _fread_nolock MultiByteToWideChar 19394->19395 19396 7ff705698dda 19395->19396 19397 7ff705698ebc 19396->19397 19398 7ff70568f8a0 _fread_nolock MultiByteToWideChar 19396->19398 19397->19392 19399 7ff70568a948 __free_lconv_num 11 API calls 19397->19399 19400 7ff705698e00 19398->19400 19399->19392 19400->19397 19401 7ff70568d5fc _fread_nolock 12 API calls 19400->19401 19402 7ff705698e2d 19400->19402 19401->19402 19402->19397 19403 7ff70568f8a0 _fread_nolock MultiByteToWideChar 19402->19403 19404 7ff705698ea4 19403->19404 19405 7ff705698ec4 19404->19405 19406 7ff705698eaa 19404->19406 19413 7ff70568ef68 19405->19413 19406->19397 19408 7ff70568a948 __free_lconv_num 11 API calls 19406->19408 19408->19397 19410 7ff705698f03 19410->19392 19412 7ff70568a948 __free_lconv_num 11 API calls 19410->19412 19411 7ff70568a948 __free_lconv_num 11 API calls 19411->19410 19412->19392 19414 7ff70568ed10 __crtLCMapStringW 5 API calls 19413->19414 19415 7ff70568efa6 19414->19415 19416 7ff70568efae 19415->19416 19417 7ff70568f1d0 __crtLCMapStringW 5 API calls 19415->19417 19416->19410 19416->19411 19418 7ff70568f017 CompareStringW 19417->19418 19418->19416 19420 7ff705697c41 19419->19420 19421 7ff705697c5a HeapSize 19419->19421 19422 7ff705684f08 _set_fmode 11 API calls 19420->19422 19423 7ff705697c46 19422->19423 19424 7ff70568a8e0 _invalid_parameter_noinfo 37 API calls 19423->19424 19425 7ff705697c51 19424->19425 19425->19077 19427 7ff705697c93 19426->19427 19428 7ff705697c89 19426->19428 19430 7ff705697c9f _set_fmode 19427->19430 19431 7ff705697c98 19427->19431 19429 7ff70568d5fc _fread_nolock 12 API calls 19428->19429 19436 7ff705697c91 19429->19436 19433 7ff705697cd2 HeapReAlloc 19430->19433 19434 7ff705697ca5 19430->19434 19437 7ff705693590 _set_fmode 2 API calls 19430->19437 19432 7ff70568a948 __free_lconv_num 11 API calls 19431->19432 19432->19436 19433->19430 19433->19436 19435 7ff705684f08 _set_fmode 11 API calls 19434->19435 19435->19436 19436->19081 19437->19430 19439 7ff70568ed10 __crtLCMapStringW 5 API calls 19438->19439 19440 7ff70568ef44 19439->19440 19440->19086 19442 7ff7056854fa 19441->19442 19443 7ff7056854d6 19441->19443 19444 7ff705685554 19442->19444 19445 7ff7056854ff 19442->19445 19447 7ff70568a948 __free_lconv_num 11 API calls 19443->19447 19448 7ff7056854e5 19443->19448 19446 7ff70568f8a0 _fread_nolock MultiByteToWideChar 19444->19446 19445->19448 19449 7ff705685514 19445->19449 19451 7ff70568a948 __free_lconv_num 11 API calls 19445->19451 19456 7ff705685570 19446->19456 19447->19448 19448->19090 19448->19091 19452 7ff70568d5fc _fread_nolock 12 API calls 19449->19452 19450 7ff705685577 GetLastError 19453 7ff705684e7c _fread_nolock 11 API calls 19450->19453 19451->19449 19452->19448 19455 7ff705685584 19453->19455 19454 7ff70568f8a0 _fread_nolock MultiByteToWideChar 19458 7ff7056855f6 19454->19458 19459 7ff705684f08 _set_fmode 11 API calls 19455->19459 19456->19450 19457 7ff7056855a5 19456->19457 19460 7ff70568a948 __free_lconv_num 11 API calls 19456->19460 19462 7ff7056855b2 19456->19462 19461 7ff70568d5fc _fread_nolock 12 API calls 19457->19461 19458->19448 19458->19450 19459->19448 19460->19457 19461->19462 19462->19448 19462->19454 19464 7ff705689225 19463->19464 19475 7ff705689221 19463->19475 19484 7ff705692a3c GetEnvironmentStringsW 19464->19484 19467 7ff705689232 19470 7ff70568a948 __free_lconv_num 11 API calls 19467->19470 19468 7ff70568923e 19491 7ff70568938c 19468->19491 19470->19475 19472 7ff70568a948 __free_lconv_num 11 API calls 19473 7ff705689265 19472->19473 19474 7ff70568a948 __free_lconv_num 11 API calls 19473->19474 19474->19475 19475->19118 19476 7ff7056895cc 19475->19476 19477 7ff7056895ef 19476->19477 19482 7ff705689606 19476->19482 19477->19118 19478 7ff70568eb98 _set_fmode 11 API calls 19478->19482 19479 7ff70568967a 19481 7ff70568a948 __free_lconv_num 11 API calls 19479->19481 19480 7ff70568f8a0 MultiByteToWideChar _fread_nolock 19480->19482 19481->19477 19482->19477 19482->19478 19482->19479 19482->19480 19483 7ff70568a948 __free_lconv_num 11 API calls 19482->19483 19483->19482 19485 7ff70568922a 19484->19485 19487 7ff705692a60 19484->19487 19485->19467 19485->19468 19486 7ff70568d5fc _fread_nolock 12 API calls 19488 7ff705692a97 memcpy_s 19486->19488 19487->19486 19487->19487 19489 7ff70568a948 __free_lconv_num 11 API calls 19488->19489 19490 7ff705692ab7 FreeEnvironmentStringsW 19489->19490 19490->19485 19492 7ff7056893b4 19491->19492 19493 7ff70568eb98 _set_fmode 11 API calls 19492->19493 19506 7ff7056893ef 19493->19506 19494 7ff7056893f7 19495 7ff70568a948 __free_lconv_num 11 API calls 19494->19495 19496 7ff705689246 19495->19496 19496->19472 19497 7ff705689471 19498 7ff70568a948 __free_lconv_num 11 API calls 19497->19498 19498->19496 19499 7ff70568eb98 _set_fmode 11 API calls 19499->19506 19500 7ff705689460 19501 7ff7056894a8 11 API calls 19500->19501 19503 7ff705689468 19501->19503 19502 7ff705690474 37 API calls 19502->19506 19504 7ff70568a948 __free_lconv_num 11 API calls 19503->19504 19504->19494 19505 7ff705689494 19507 7ff70568a900 _isindst 17 API calls 19505->19507 19506->19494 19506->19497 19506->19499 19506->19500 19506->19502 19506->19505 19508 7ff70568a948 __free_lconv_num 11 API calls 19506->19508 19509 7ff7056894a6 19507->19509 19508->19506 19512 7ff705698b31 __crtLCMapStringW 19510->19512 19511 7ff7056970ee 19511->19145 19511->19146 19512->19511 19513 7ff70568ef68 6 API calls 19512->19513 19513->19511 20340 7ff70567cb50 20341 7ff70567cb60 20340->20341 20357 7ff705689ba8 20341->20357 20343 7ff70567cb6c 20363 7ff70567ce48 20343->20363 20345 7ff70567d12c 7 API calls 20347 7ff70567cc05 20345->20347 20346 7ff70567cb84 _RTC_Initialize 20355 7ff70567cbd9 20346->20355 20368 7ff70567cff8 20346->20368 20349 7ff70567cb99 20371 7ff705689014 20349->20371 20355->20345 20356 7ff70567cbf5 20355->20356 20358 7ff705689bb9 20357->20358 20359 7ff705689bc1 20358->20359 20360 7ff705684f08 _set_fmode 11 API calls 20358->20360 20359->20343 20361 7ff705689bd0 20360->20361 20362 7ff70568a8e0 _invalid_parameter_noinfo 37 API calls 20361->20362 20362->20359 20364 7ff70567ce59 20363->20364 20367 7ff70567ce5e __scrt_release_startup_lock 20363->20367 20365 7ff70567d12c 7 API calls 20364->20365 20364->20367 20366 7ff70567ced2 20365->20366 20367->20346 20396 7ff70567cfbc 20368->20396 20370 7ff70567d001 20370->20349 20372 7ff705689034 20371->20372 20394 7ff70567cba5 20371->20394 20373 7ff705689052 GetModuleFileNameW 20372->20373 20374 7ff70568903c 20372->20374 20378 7ff70568907d 20373->20378 20375 7ff705684f08 _set_fmode 11 API calls 20374->20375 20376 7ff705689041 20375->20376 20377 7ff70568a8e0 _invalid_parameter_noinfo 37 API calls 20376->20377 20377->20394 20379 7ff705688fb4 11 API calls 20378->20379 20380 7ff7056890bd 20379->20380 20381 7ff7056890c5 20380->20381 20382 7ff7056890dd 20380->20382 20383 7ff705684f08 _set_fmode 11 API calls 20381->20383 20387 7ff705689144 20382->20387 20388 7ff70568912b 20382->20388 20393 7ff7056890ff 20382->20393 20384 7ff7056890ca 20383->20384 20385 7ff70568a948 __free_lconv_num 11 API calls 20384->20385 20385->20394 20386 7ff70568a948 __free_lconv_num 11 API calls 20386->20394 20391 7ff70568a948 __free_lconv_num 11 API calls 20387->20391 20389 7ff70568a948 __free_lconv_num 11 API calls 20388->20389 20390 7ff705689134 20389->20390 20392 7ff70568a948 __free_lconv_num 11 API calls 20390->20392 20391->20393 20392->20394 20393->20386 20394->20355 20395 7ff70567d0cc InitializeSListHead 20394->20395 20397 7ff70567cfd6 20396->20397 20399 7ff70567cfcf 20396->20399 20400 7ff70568a1ec 20397->20400 20399->20370 20403 7ff705689e28 20400->20403 20410 7ff7056902d8 EnterCriticalSection 20403->20410 15918 7ff70567cc3c 15939 7ff70567ce0c 15918->15939 15921 7ff70567cd88 16093 7ff70567d12c IsProcessorFeaturePresent 15921->16093 15922 7ff70567cc58 __scrt_acquire_startup_lock 15924 7ff70567cd92 15922->15924 15929 7ff70567cc76 __scrt_release_startup_lock 15922->15929 15925 7ff70567d12c 7 API calls 15924->15925 15927 7ff70567cd9d __CxxCallCatchBlock 15925->15927 15926 7ff70567cc9b 15928 7ff70567cd21 15945 7ff70567d274 15928->15945 15929->15926 15929->15928 16082 7ff705689b2c 15929->16082 15931 7ff70567cd26 15948 7ff705671000 15931->15948 15936 7ff70567cd49 15936->15927 16089 7ff70567cf90 15936->16089 15940 7ff70567ce14 15939->15940 15941 7ff70567ce20 __scrt_dllmain_crt_thread_attach 15940->15941 15942 7ff70567cc50 15941->15942 15943 7ff70567ce2d 15941->15943 15942->15921 15942->15922 15943->15942 16100 7ff70567d888 15943->16100 16127 7ff70569a4d0 15945->16127 15949 7ff705671009 15948->15949 16129 7ff705685484 15949->16129 15951 7ff7056737fb 16136 7ff7056736b0 15951->16136 15958 7ff70567391b 16305 7ff7056745c0 15958->16305 15959 7ff70567383c 16296 7ff705671c80 15959->16296 15963 7ff70567385b 16208 7ff705678830 15963->16208 15964 7ff70567396a 16328 7ff705672710 15964->16328 15968 7ff70567388e 15975 7ff7056738bb __std_exception_destroy 15968->15975 16300 7ff7056789a0 15968->16300 15969 7ff70567395d 15970 7ff705673984 15969->15970 15971 7ff705673962 15969->15971 15973 7ff705671c80 49 API calls 15970->15973 16324 7ff70568004c 15971->16324 15976 7ff7056739a3 15973->15976 15977 7ff705678830 14 API calls 15975->15977 15985 7ff7056738de __std_exception_destroy 15975->15985 15981 7ff705671950 115 API calls 15976->15981 15977->15985 15979 7ff705673a0b 15980 7ff7056789a0 40 API calls 15979->15980 15982 7ff705673a17 15980->15982 15983 7ff7056739ce 15981->15983 15986 7ff7056789a0 40 API calls 15982->15986 15983->15963 15984 7ff7056739de 15983->15984 15987 7ff705672710 54 API calls 15984->15987 15990 7ff70567390e __std_exception_destroy 15985->15990 16339 7ff705678940 15985->16339 15988 7ff705673a23 15986->15988 15996 7ff705673808 __std_exception_destroy 15987->15996 15989 7ff7056789a0 40 API calls 15988->15989 15989->15990 15991 7ff705678830 14 API calls 15990->15991 15992 7ff705673a3b 15991->15992 15993 7ff705673b2f 15992->15993 15994 7ff705673a60 __std_exception_destroy 15992->15994 15995 7ff705672710 54 API calls 15993->15995 15997 7ff705678940 40 API calls 15994->15997 16005 7ff705673aab 15994->16005 15995->15996 16346 7ff70567c550 15996->16346 15997->16005 15998 7ff705678830 14 API calls 15999 7ff705673bf4 __std_exception_destroy 15998->15999 16000 7ff705673c46 15999->16000 16001 7ff705673d41 15999->16001 16002 7ff705673cd4 16000->16002 16003 7ff705673c50 16000->16003 16355 7ff7056744e0 16001->16355 16007 7ff705678830 14 API calls 16002->16007 16221 7ff7056790e0 16003->16221 16005->15998 16010 7ff705673ce0 16007->16010 16008 7ff705673d4f 16011 7ff705673d65 16008->16011 16012 7ff705673d71 16008->16012 16013 7ff705673c61 16010->16013 16017 7ff705673ced 16010->16017 16358 7ff705674630 16011->16358 16015 7ff705671c80 49 API calls 16012->16015 16019 7ff705672710 54 API calls 16013->16019 16026 7ff705673cc8 __std_exception_destroy 16015->16026 16020 7ff705671c80 49 API calls 16017->16020 16019->15996 16023 7ff705673d0b 16020->16023 16021 7ff705673dc4 16271 7ff705679390 16021->16271 16023->16026 16027 7ff705673d12 16023->16027 16024 7ff705673da7 SetDllDirectoryW LoadLibraryExW 16024->16021 16025 7ff705673dd7 SetDllDirectoryW 16030 7ff705673e0a 16025->16030 16072 7ff705673e5a 16025->16072 16026->16021 16026->16024 16029 7ff705672710 54 API calls 16027->16029 16029->15996 16032 7ff705678830 14 API calls 16030->16032 16031 7ff705674008 16034 7ff705674035 16031->16034 16035 7ff705674012 PostMessageW GetMessageW 16031->16035 16038 7ff705673e16 __std_exception_destroy 16032->16038 16033 7ff705673f1b 16276 7ff7056733c0 16033->16276 16435 7ff705673360 16034->16435 16035->16034 16040 7ff705673ef2 16038->16040 16044 7ff705673e4e 16038->16044 16043 7ff705678940 40 API calls 16040->16043 16043->16072 16044->16072 16361 7ff705676dc0 16044->16361 16072->16031 16072->16033 16083 7ff705689b43 16082->16083 16084 7ff705689b64 16082->16084 16083->15928 18671 7ff70568a3d8 16084->18671 16087 7ff70567d2b8 GetModuleHandleW 16088 7ff70567d2c9 16087->16088 16088->15936 16090 7ff70567cfa1 16089->16090 16091 7ff70567cd60 16090->16091 16092 7ff70567d888 7 API calls 16090->16092 16091->15926 16092->16091 16094 7ff70567d152 _isindst __scrt_get_show_window_mode 16093->16094 16095 7ff70567d171 RtlCaptureContext RtlLookupFunctionEntry 16094->16095 16096 7ff70567d19a RtlVirtualUnwind 16095->16096 16097 7ff70567d1d6 __scrt_get_show_window_mode 16095->16097 16096->16097 16098 7ff70567d208 IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter 16097->16098 16099 7ff70567d256 _isindst 16098->16099 16099->15924 16101 7ff70567d89a 16100->16101 16102 7ff70567d890 16100->16102 16101->15942 16106 7ff70567dc24 16102->16106 16107 7ff70567dc33 16106->16107 16109 7ff70567d895 16106->16109 16114 7ff70567de60 16107->16114 16110 7ff70567dc90 16109->16110 16111 7ff70567dcbb 16110->16111 16112 7ff70567dc9e DeleteCriticalSection 16111->16112 16113 7ff70567dcbf 16111->16113 16112->16111 16113->16101 16118 7ff70567dcc8 16114->16118 16119 7ff70567ddb2 TlsFree 16118->16119 16121 7ff70567dd0c __vcrt_InitializeCriticalSectionEx 16118->16121 16120 7ff70567dd3a LoadLibraryExW 16123 7ff70567dd5b GetLastError 16120->16123 16124 7ff70567ddd9 16120->16124 16121->16119 16121->16120 16122 7ff70567ddf9 GetProcAddress 16121->16122 16126 7ff70567dd7d LoadLibraryExW 16121->16126 16122->16119 16123->16121 16124->16122 16125 7ff70567ddf0 FreeLibrary 16124->16125 16125->16122 16126->16121 16126->16124 16128 7ff70567d28b GetStartupInfoW 16127->16128 16128->15931 16131 7ff70568f480 16129->16131 16130 7ff70568f4d3 16448 7ff70568a814 16130->16448 16131->16130 16133 7ff70568f526 16131->16133 16458 7ff70568f358 16133->16458 16135 7ff70568f4fc 16135->15951 16565 7ff70567c850 16136->16565 16139 7ff7056736eb GetLastError 16572 7ff705672c50 16139->16572 16140 7ff705673710 16567 7ff705679280 FindFirstFileExW 16140->16567 16143 7ff705673706 16148 7ff70567c550 _log10_special 8 API calls 16143->16148 16145 7ff70567377d 16598 7ff705679440 16145->16598 16146 7ff705673723 16587 7ff705679300 CreateFileW 16146->16587 16151 7ff7056737b5 16148->16151 16150 7ff70567378b 16150->16143 16154 7ff705672810 49 API calls 16150->16154 16151->15996 16158 7ff705671950 16151->16158 16153 7ff705673734 16590 7ff705672810 16153->16590 16154->16143 16157 7ff70567374c __vcrt_InitializeCriticalSectionEx 16157->16145 16159 7ff7056745c0 108 API calls 16158->16159 16160 7ff705671985 16159->16160 16161 7ff705671c43 16160->16161 16162 7ff705677f90 83 API calls 16160->16162 16163 7ff70567c550 _log10_special 8 API calls 16161->16163 16165 7ff7056719cb 16162->16165 16164 7ff705671c5e 16163->16164 16164->15958 16164->15959 16178 7ff705671a03 16165->16178 17003 7ff7056806d4 16165->17003 16167 7ff70568004c 74 API calls 16167->16161 16168 7ff7056719e5 16169 7ff7056719e9 16168->16169 16170 7ff705671a08 16168->16170 16172 7ff705684f08 _set_fmode 11 API calls 16169->16172 17007 7ff70568039c 16170->17007 16174 7ff7056719ee 16172->16174 17010 7ff705672910 16174->17010 16175 7ff705671a45 16182 7ff705671a7b 16175->16182 16183 7ff705671a5c 16175->16183 16176 7ff705671a26 16179 7ff705684f08 _set_fmode 11 API calls 16176->16179 16178->16167 16180 7ff705671a2b 16179->16180 16181 7ff705672910 54 API calls 16180->16181 16181->16178 16184 7ff705671c80 49 API calls 16182->16184 16185 7ff705684f08 _set_fmode 11 API calls 16183->16185 16186 7ff705671a92 16184->16186 16187 7ff705671a61 16185->16187 16188 7ff705671c80 49 API calls 16186->16188 16189 7ff705672910 54 API calls 16187->16189 16190 7ff705671add 16188->16190 16189->16178 16191 7ff7056806d4 73 API calls 16190->16191 16192 7ff705671b01 16191->16192 16193 7ff705671b35 16192->16193 16194 7ff705671b16 16192->16194 16195 7ff70568039c _fread_nolock 53 API calls 16193->16195 16196 7ff705684f08 _set_fmode 11 API calls 16194->16196 16197 7ff705671b4a 16195->16197 16198 7ff705671b1b 16196->16198 16199 7ff705671b6f 16197->16199 16200 7ff705671b50 16197->16200 16201 7ff705672910 54 API calls 16198->16201 17025 7ff705680110 16199->17025 16202 7ff705684f08 _set_fmode 11 API calls 16200->16202 16201->16178 16204 7ff705671b55 16202->16204 16206 7ff705672910 54 API calls 16204->16206 16206->16178 16207 7ff705672710 54 API calls 16207->16178 16209 7ff70567883a 16208->16209 16210 7ff705679390 2 API calls 16209->16210 16211 7ff705678859 GetEnvironmentVariableW 16210->16211 16212 7ff705678876 ExpandEnvironmentStringsW 16211->16212 16213 7ff7056788c2 16211->16213 16212->16213 16214 7ff705678898 16212->16214 16215 7ff70567c550 _log10_special 8 API calls 16213->16215 16216 7ff705679440 2 API calls 16214->16216 16217 7ff7056788d4 16215->16217 16218 7ff7056788aa 16216->16218 16217->15968 16219 7ff70567c550 _log10_special 8 API calls 16218->16219 16220 7ff7056788ba 16219->16220 16220->15968 16222 7ff7056790f5 16221->16222 17243 7ff705678570 GetCurrentProcess OpenProcessToken 16222->17243 16225 7ff705678570 7 API calls 16226 7ff705679121 16225->16226 16227 7ff70567913a 16226->16227 16228 7ff705679154 16226->16228 16229 7ff7056726b0 48 API calls 16227->16229 16230 7ff7056726b0 48 API calls 16228->16230 16232 7ff705679152 16229->16232 16231 7ff705679167 LocalFree LocalFree 16230->16231 16233 7ff705679183 16231->16233 16235 7ff70567918f 16231->16235 16232->16231 17253 7ff705672b50 16233->17253 16236 7ff70567c550 _log10_special 8 API calls 16235->16236 16237 7ff705673c55 16236->16237 16237->16013 16238 7ff705678660 16237->16238 16239 7ff705678678 16238->16239 16240 7ff70567869c 16239->16240 16241 7ff7056786fa GetTempPathW GetCurrentProcessId 16239->16241 16243 7ff705678830 14 API calls 16240->16243 17262 7ff7056725c0 16241->17262 16244 7ff7056786a8 16243->16244 17269 7ff7056781d0 16244->17269 16253 7ff705678728 __std_exception_destroy 16257 7ff705678765 __std_exception_destroy 16253->16257 17266 7ff705688b68 16253->17266 16256 7ff70567c550 _log10_special 8 API calls 16259 7ff705673cbb 16256->16259 16262 7ff705679390 2 API calls 16257->16262 16270 7ff7056787d4 __std_exception_destroy 16257->16270 16259->16013 16259->16026 16263 7ff7056787b1 16262->16263 16264 7ff7056787e9 16263->16264 16265 7ff7056787b6 16263->16265 16266 7ff705688238 38 API calls 16264->16266 16267 7ff705679390 2 API calls 16265->16267 16266->16270 16270->16256 16272 7ff7056793b2 MultiByteToWideChar 16271->16272 16273 7ff7056793d6 16271->16273 16272->16273 16275 7ff7056793ec __std_exception_destroy 16272->16275 16274 7ff7056793f3 MultiByteToWideChar 16273->16274 16273->16275 16274->16275 16275->16025 16288 7ff7056733ce __scrt_get_show_window_mode 16276->16288 16277 7ff70567c550 _log10_special 8 API calls 16278 7ff705673664 16277->16278 16278->15996 16295 7ff7056790c0 LocalFree 16278->16295 16279 7ff7056735c7 16279->16277 16281 7ff705671c80 49 API calls 16281->16288 16282 7ff7056735e2 16284 7ff705672710 54 API calls 16282->16284 16284->16279 16287 7ff7056735c9 16289 7ff705672710 54 API calls 16287->16289 16288->16279 16288->16281 16288->16282 16288->16287 16290 7ff705672a50 54 API calls 16288->16290 16293 7ff7056735d0 16288->16293 17558 7ff705674560 16288->17558 17564 7ff705677e20 16288->17564 17575 7ff705671600 16288->17575 17623 7ff705677120 16288->17623 17627 7ff705674190 16288->17627 17671 7ff705674450 16288->17671 16289->16279 16290->16288 16294 7ff705672710 54 API calls 16293->16294 16294->16279 16297 7ff705671ca5 16296->16297 16298 7ff705684984 49 API calls 16297->16298 16299 7ff705671cc8 16298->16299 16299->15963 16301 7ff705679390 2 API calls 16300->16301 16302 7ff7056789b4 16301->16302 16303 7ff705688238 38 API calls 16302->16303 16304 7ff7056789c6 __std_exception_destroy 16303->16304 16304->15975 16306 7ff7056745cc 16305->16306 16307 7ff705679390 2 API calls 16306->16307 16308 7ff7056745f4 16307->16308 16309 7ff705679390 2 API calls 16308->16309 16310 7ff705674607 16309->16310 17854 7ff705685f94 16310->17854 16313 7ff70567c550 _log10_special 8 API calls 16314 7ff70567392b 16313->16314 16314->15964 16315 7ff705677f90 16314->16315 16316 7ff705677fb4 16315->16316 16317 7ff70567808b __std_exception_destroy 16316->16317 16318 7ff7056806d4 73 API calls 16316->16318 16317->15969 16319 7ff705677fd0 16318->16319 16319->16317 18245 7ff7056878c8 16319->18245 16321 7ff7056806d4 73 API calls 16323 7ff705677fe5 16321->16323 16322 7ff70568039c _fread_nolock 53 API calls 16322->16323 16323->16317 16323->16321 16323->16322 16325 7ff70568007c 16324->16325 18260 7ff70567fe28 16325->18260 16327 7ff705680095 16327->15964 16329 7ff70567c850 16328->16329 16330 7ff705672734 GetCurrentProcessId 16329->16330 16331 7ff705671c80 49 API calls 16330->16331 16332 7ff705672787 16331->16332 16333 7ff705684984 49 API calls 16332->16333 16334 7ff7056727cf 16333->16334 16335 7ff705672620 12 API calls 16334->16335 16336 7ff7056727f1 16335->16336 16337 7ff70567c550 _log10_special 8 API calls 16336->16337 16338 7ff705672801 16337->16338 16338->15996 16340 7ff705679390 2 API calls 16339->16340 16341 7ff70567895c 16340->16341 16342 7ff705679390 2 API calls 16341->16342 16343 7ff70567896c 16342->16343 16344 7ff705688238 38 API calls 16343->16344 16345 7ff70567897a __std_exception_destroy 16344->16345 16345->15979 16347 7ff70567c559 16346->16347 16348 7ff705673ca7 16347->16348 16349 7ff70567c8e0 IsProcessorFeaturePresent 16347->16349 16348->16087 16350 7ff70567c8f8 16349->16350 18271 7ff70567cad8 RtlCaptureContext 16350->18271 16356 7ff705671c80 49 API calls 16355->16356 16357 7ff7056744fd 16356->16357 16357->16008 16359 7ff705671c80 49 API calls 16358->16359 16360 7ff705674660 16359->16360 16360->16026 16362 7ff705676dd5 16361->16362 16363 7ff705673e6c 16362->16363 16364 7ff705684f08 _set_fmode 11 API calls 16362->16364 16367 7ff705677340 16363->16367 16365 7ff705676de2 16364->16365 16366 7ff705672910 54 API calls 16365->16366 16366->16363 18276 7ff705671470 16367->18276 16369 7ff705677368 18382 7ff705676360 16435->18382 16438 7ff705673399 16444 7ff705673670 16438->16444 16465 7ff70568a55c 16448->16465 16454 7ff70568a84f 16454->16135 16564 7ff70568546c EnterCriticalSection 16458->16564 16466 7ff70568a5b3 16465->16466 16467 7ff70568a578 GetLastError 16465->16467 16466->16454 16471 7ff70568a5c8 16466->16471 16468 7ff70568a588 16467->16468 16478 7ff70568b390 16468->16478 16472 7ff70568a5e4 GetLastError SetLastError 16471->16472 16473 7ff70568a5fc 16471->16473 16472->16473 16473->16454 16474 7ff70568a900 IsProcessorFeaturePresent 16473->16474 16475 7ff70568a913 16474->16475 16556 7ff70568a614 16475->16556 16479 7ff70568b3af FlsGetValue 16478->16479 16480 7ff70568b3ca FlsSetValue 16478->16480 16481 7ff70568b3c4 16479->16481 16484 7ff70568a5a3 SetLastError 16479->16484 16482 7ff70568b3d7 16480->16482 16480->16484 16481->16480 16495 7ff70568eb98 16482->16495 16484->16466 16486 7ff70568b404 FlsSetValue 16489 7ff70568b410 FlsSetValue 16486->16489 16490 7ff70568b422 16486->16490 16487 7ff70568b3f4 FlsSetValue 16488 7ff70568b3fd 16487->16488 16502 7ff70568a948 16488->16502 16489->16488 16508 7ff70568aef4 16490->16508 16500 7ff70568eba9 _set_fmode 16495->16500 16496 7ff70568ebfa 16516 7ff705684f08 16496->16516 16497 7ff70568ebde HeapAlloc 16499 7ff70568b3e6 16497->16499 16497->16500 16499->16486 16499->16487 16500->16496 16500->16497 16513 7ff705693590 16500->16513 16503 7ff70568a94d RtlFreeHeap 16502->16503 16505 7ff70568a97c 16502->16505 16504 7ff70568a968 GetLastError 16503->16504 16503->16505 16506 7ff70568a975 __free_lconv_num 16504->16506 16505->16484 16507 7ff705684f08 _set_fmode 9 API calls 16506->16507 16507->16505 16542 7ff70568adcc 16508->16542 16519 7ff7056935d0 16513->16519 16525 7ff70568b2c8 GetLastError 16516->16525 16518 7ff705684f11 16518->16499 16524 7ff7056902d8 EnterCriticalSection 16519->16524 16526 7ff70568b309 FlsSetValue 16525->16526 16528 7ff70568b2ec 16525->16528 16527 7ff70568b31b 16526->16527 16540 7ff70568b2f9 16526->16540 16530 7ff70568eb98 _set_fmode 5 API calls 16527->16530 16528->16526 16528->16540 16529 7ff70568b375 SetLastError 16529->16518 16531 7ff70568b32a 16530->16531 16532 7ff70568b348 FlsSetValue 16531->16532 16533 7ff70568b338 FlsSetValue 16531->16533 16535 7ff70568b354 FlsSetValue 16532->16535 16536 7ff70568b366 16532->16536 16534 7ff70568b341 16533->16534 16537 7ff70568a948 __free_lconv_num 5 API calls 16534->16537 16535->16534 16538 7ff70568aef4 _set_fmode 5 API calls 16536->16538 16537->16540 16539 7ff70568b36e 16538->16539 16541 7ff70568a948 __free_lconv_num 5 API calls 16539->16541 16540->16529 16541->16529 16554 7ff7056902d8 EnterCriticalSection 16542->16554 16557 7ff70568a64e _isindst __scrt_get_show_window_mode 16556->16557 16558 7ff70568a676 RtlCaptureContext RtlLookupFunctionEntry 16557->16558 16559 7ff70568a6b0 RtlVirtualUnwind 16558->16559 16560 7ff70568a6e6 IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter 16558->16560 16559->16560 16561 7ff70568a738 _isindst 16560->16561 16562 7ff70567c550 _log10_special 8 API calls 16561->16562 16563 7ff70568a757 GetCurrentProcess TerminateProcess 16562->16563 16566 7ff7056736bc GetModuleFileNameW 16565->16566 16566->16139 16566->16140 16568 7ff7056792d2 16567->16568 16569 7ff7056792bf FindClose 16567->16569 16570 7ff70567c550 _log10_special 8 API calls 16568->16570 16569->16568 16571 7ff70567371a 16570->16571 16571->16145 16571->16146 16573 7ff70567c850 16572->16573 16574 7ff705672c70 GetCurrentProcessId 16573->16574 16603 7ff7056726b0 16574->16603 16576 7ff705672cb9 16607 7ff705684bd8 16576->16607 16579 7ff7056726b0 48 API calls 16580 7ff705672d34 FormatMessageW 16579->16580 16582 7ff705672d6d 16580->16582 16583 7ff705672d7f MessageBoxW 16580->16583 16584 7ff7056726b0 48 API calls 16582->16584 16585 7ff70567c550 _log10_special 8 API calls 16583->16585 16584->16583 16586 7ff705672daf 16585->16586 16586->16143 16588 7ff705673730 16587->16588 16589 7ff705679340 GetFinalPathNameByHandleW CloseHandle 16587->16589 16588->16153 16588->16157 16589->16588 16591 7ff705672834 16590->16591 16592 7ff7056726b0 48 API calls 16591->16592 16593 7ff705672887 16592->16593 16594 7ff705684bd8 48 API calls 16593->16594 16595 7ff7056728d0 MessageBoxW 16594->16595 16596 7ff70567c550 _log10_special 8 API calls 16595->16596 16597 7ff705672900 16596->16597 16597->16143 16599 7ff70567946a WideCharToMultiByte 16598->16599 16602 7ff705679495 16598->16602 16601 7ff7056794ab __std_exception_destroy 16599->16601 16599->16602 16600 7ff7056794b2 WideCharToMultiByte 16600->16601 16601->16150 16602->16600 16602->16601 16604 7ff7056726d5 16603->16604 16605 7ff705684bd8 48 API calls 16604->16605 16606 7ff7056726f8 16605->16606 16606->16576 16608 7ff705684c32 16607->16608 16609 7ff705684c57 16608->16609 16611 7ff705684c93 16608->16611 16610 7ff70568a814 _invalid_parameter_noinfo 37 API calls 16609->16610 16613 7ff705684c81 16610->16613 16625 7ff705682f90 16611->16625 16615 7ff70567c550 _log10_special 8 API calls 16613->16615 16614 7ff705684d74 16616 7ff70568a948 __free_lconv_num 11 API calls 16614->16616 16617 7ff705672d04 16615->16617 16616->16613 16617->16579 16619 7ff705684d9a 16619->16614 16621 7ff705684da4 16619->16621 16620 7ff705684d49 16622 7ff70568a948 __free_lconv_num 11 API calls 16620->16622 16624 7ff70568a948 __free_lconv_num 11 API calls 16621->16624 16622->16613 16623 7ff705684d40 16623->16614 16623->16620 16624->16613 16626 7ff705682fce 16625->16626 16627 7ff705682fbe 16625->16627 16628 7ff705682fd7 16626->16628 16633 7ff705683005 16626->16633 16629 7ff70568a814 _invalid_parameter_noinfo 37 API calls 16627->16629 16630 7ff70568a814 _invalid_parameter_noinfo 37 API calls 16628->16630 16631 7ff705682ffd 16629->16631 16630->16631 16631->16614 16631->16619 16631->16620 16631->16623 16633->16627 16633->16631 16636 7ff7056839a4 16633->16636 16669 7ff7056833f0 16633->16669 16706 7ff705682b80 16633->16706 16637 7ff705683a57 16636->16637 16638 7ff7056839e6 16636->16638 16641 7ff705683a5c 16637->16641 16642 7ff705683ab0 16637->16642 16639 7ff7056839ec 16638->16639 16640 7ff705683a81 16638->16640 16643 7ff7056839f1 16639->16643 16644 7ff705683a20 16639->16644 16729 7ff705681d54 16640->16729 16645 7ff705683a5e 16641->16645 16646 7ff705683a91 16641->16646 16647 7ff705683aba 16642->16647 16648 7ff705683ac7 16642->16648 16653 7ff705683abf 16642->16653 16643->16648 16650 7ff7056839f7 16643->16650 16644->16650 16644->16653 16651 7ff705683a00 16645->16651 16656 7ff705683a6d 16645->16656 16736 7ff705681944 16646->16736 16647->16640 16647->16653 16743 7ff7056846ac 16648->16743 16650->16651 16657 7ff705683a32 16650->16657 16666 7ff705683a1b 16650->16666 16667 7ff705683af0 16651->16667 16709 7ff705684158 16651->16709 16653->16667 16747 7ff705682164 16653->16747 16656->16640 16659 7ff705683a72 16656->16659 16657->16667 16719 7ff705684494 16657->16719 16659->16667 16725 7ff705684558 16659->16725 16661 7ff70567c550 _log10_special 8 API calls 16663 7ff705683dea 16661->16663 16663->16633 16666->16667 16668 7ff705683cdc 16666->16668 16754 7ff7056847c0 16666->16754 16667->16661 16668->16667 16760 7ff70568ea08 16668->16760 16670 7ff7056833fe 16669->16670 16671 7ff705683414 16669->16671 16672 7ff705683454 16670->16672 16673 7ff705683a57 16670->16673 16674 7ff7056839e6 16670->16674 16671->16672 16675 7ff70568a814 _invalid_parameter_noinfo 37 API calls 16671->16675 16672->16633 16678 7ff705683a5c 16673->16678 16679 7ff705683ab0 16673->16679 16676 7ff7056839ec 16674->16676 16677 7ff705683a81 16674->16677 16675->16672 16680 7ff7056839f1 16676->16680 16681 7ff705683a20 16676->16681 16686 7ff705681d54 38 API calls 16677->16686 16682 7ff705683a5e 16678->16682 16683 7ff705683a91 16678->16683 16684 7ff705683aba 16679->16684 16685 7ff705683ac7 16679->16685 16691 7ff705683abf 16679->16691 16680->16685 16687 7ff7056839f7 16680->16687 16681->16687 16681->16691 16688 7ff705683a00 16682->16688 16693 7ff705683a6d 16682->16693 16689 7ff705681944 38 API calls 16683->16689 16684->16677 16684->16691 16692 7ff7056846ac 45 API calls 16685->16692 16702 7ff705683a1b 16686->16702 16687->16688 16694 7ff705683a32 16687->16694 16687->16702 16690 7ff705684158 47 API calls 16688->16690 16704 7ff705683af0 16688->16704 16689->16702 16690->16702 16695 7ff705682164 38 API calls 16691->16695 16691->16704 16692->16702 16693->16677 16696 7ff705683a72 16693->16696 16697 7ff705684494 46 API calls 16694->16697 16694->16704 16695->16702 16699 7ff705684558 37 API calls 16696->16699 16696->16704 16697->16702 16698 7ff70567c550 _log10_special 8 API calls 16700 7ff705683dea 16698->16700 16699->16702 16700->16633 16701 7ff7056847c0 45 API calls 16705 7ff705683cdc 16701->16705 16702->16701 16702->16704 16702->16705 16703 7ff70568ea08 46 API calls 16703->16705 16704->16698 16705->16703 16705->16704 16986 7ff705680fc8 16706->16986 16710 7ff70568417e 16709->16710 16772 7ff705680b80 16710->16772 16715 7ff7056847c0 45 API calls 16716 7ff7056842c3 16715->16716 16716->16716 16717 7ff7056847c0 45 API calls 16716->16717 16718 7ff705684351 16716->16718 16717->16718 16718->16666 16720 7ff7056844c9 16719->16720 16721 7ff70568450e 16720->16721 16722 7ff7056844e7 16720->16722 16723 7ff7056847c0 45 API calls 16720->16723 16721->16666 16724 7ff70568ea08 46 API calls 16722->16724 16723->16722 16724->16721 16726 7ff705684579 16725->16726 16727 7ff70568a814 _invalid_parameter_noinfo 37 API calls 16726->16727 16728 7ff7056845aa 16726->16728 16727->16728 16728->16666 16730 7ff705681d87 16729->16730 16731 7ff705681db6 16730->16731 16733 7ff705681e73 16730->16733 16735 7ff705681df3 16731->16735 16918 7ff705680c28 16731->16918 16734 7ff70568a814 _invalid_parameter_noinfo 37 API calls 16733->16734 16734->16735 16735->16666 16737 7ff705681977 16736->16737 16738 7ff7056819a6 16737->16738 16740 7ff705681a63 16737->16740 16739 7ff705680c28 12 API calls 16738->16739 16742 7ff7056819e3 16738->16742 16739->16742 16741 7ff70568a814 _invalid_parameter_noinfo 37 API calls 16740->16741 16741->16742 16742->16666 16744 7ff7056846ef 16743->16744 16746 7ff7056846f3 __crtLCMapStringW 16744->16746 16926 7ff705684748 16744->16926 16746->16666 16748 7ff705682197 16747->16748 16749 7ff7056821c6 16748->16749 16751 7ff705682283 16748->16751 16750 7ff705680c28 12 API calls 16749->16750 16753 7ff705682203 16749->16753 16750->16753 16752 7ff70568a814 _invalid_parameter_noinfo 37 API calls 16751->16752 16752->16753 16753->16666 16755 7ff7056847d7 16754->16755 16930 7ff70568d9b8 16755->16930 16761 7ff70568ea39 16760->16761 16770 7ff70568ea47 16760->16770 16762 7ff70568ea67 16761->16762 16765 7ff7056847c0 45 API calls 16761->16765 16761->16770 16763 7ff70568ea9f 16762->16763 16764 7ff70568ea78 16762->16764 16767 7ff70568eac9 16763->16767 16768 7ff70568eb2a 16763->16768 16763->16770 16976 7ff7056900a0 16764->16976 16765->16762 16767->16770 16979 7ff70568f8a0 16767->16979 16769 7ff70568f8a0 _fread_nolock MultiByteToWideChar 16768->16769 16769->16770 16770->16668 16773 7ff705680ba6 16772->16773 16774 7ff705680bb7 16772->16774 16780 7ff70568e570 16773->16780 16774->16773 16802 7ff70568d5fc 16774->16802 16777 7ff705680bf8 16779 7ff70568a948 __free_lconv_num 11 API calls 16777->16779 16778 7ff70568a948 __free_lconv_num 11 API calls 16778->16777 16779->16773 16781 7ff70568e5c0 16780->16781 16782 7ff70568e58d 16780->16782 16781->16782 16784 7ff70568e5f2 16781->16784 16783 7ff70568a814 _invalid_parameter_noinfo 37 API calls 16782->16783 16792 7ff7056842a1 16783->16792 16785 7ff70568e705 16784->16785 16795 7ff70568e63a 16784->16795 16786 7ff70568e7f7 16785->16786 16788 7ff70568e7bd 16785->16788 16790 7ff70568e78c 16785->16790 16791 7ff70568e74f 16785->16791 16794 7ff70568e745 16785->16794 16842 7ff70568da5c 16786->16842 16835 7ff70568ddf4 16788->16835 16828 7ff70568e0d4 16790->16828 16818 7ff70568e304 16791->16818 16792->16715 16792->16716 16794->16788 16797 7ff70568e74a 16794->16797 16795->16792 16809 7ff70568a4a4 16795->16809 16797->16790 16797->16791 16800 7ff70568a900 _isindst 17 API calls 16801 7ff70568e854 16800->16801 16803 7ff70568d647 16802->16803 16808 7ff70568d60b _set_fmode 16802->16808 16805 7ff705684f08 _set_fmode 11 API calls 16803->16805 16804 7ff70568d62e HeapAlloc 16806 7ff705680be4 16804->16806 16804->16808 16805->16806 16806->16777 16806->16778 16807 7ff705693590 _set_fmode 2 API calls 16807->16808 16808->16803 16808->16804 16808->16807 16810 7ff70568a4b1 16809->16810 16811 7ff70568a4bb 16809->16811 16810->16811 16816 7ff70568a4d6 16810->16816 16812 7ff705684f08 _set_fmode 11 API calls 16811->16812 16813 7ff70568a4c2 16812->16813 16851 7ff70568a8e0 16813->16851 16814 7ff70568a4ce 16814->16792 16814->16800 16816->16814 16817 7ff705684f08 _set_fmode 11 API calls 16816->16817 16817->16813 16854 7ff7056940ac 16818->16854 16822 7ff70568e3ac 16823 7ff70568e401 16822->16823 16825 7ff70568e3cc 16822->16825 16827 7ff70568e3b0 16822->16827 16907 7ff70568def0 16823->16907 16903 7ff70568e1ac 16825->16903 16827->16792 16829 7ff7056940ac 38 API calls 16828->16829 16830 7ff70568e11e 16829->16830 16831 7ff705693af4 37 API calls 16830->16831 16832 7ff70568e16e 16831->16832 16833 7ff70568e172 16832->16833 16834 7ff70568e1ac 45 API calls 16832->16834 16833->16792 16834->16833 16836 7ff7056940ac 38 API calls 16835->16836 16837 7ff70568de3f 16836->16837 16838 7ff705693af4 37 API calls 16837->16838 16839 7ff70568de97 16838->16839 16840 7ff70568de9b 16839->16840 16841 7ff70568def0 45 API calls 16839->16841 16840->16792 16841->16840 16843 7ff70568daa1 16842->16843 16844 7ff70568dad4 16842->16844 16845 7ff70568a814 _invalid_parameter_noinfo 37 API calls 16843->16845 16846 7ff70568daec 16844->16846 16848 7ff70568db6d 16844->16848 16850 7ff70568dacd __scrt_get_show_window_mode 16845->16850 16847 7ff70568ddf4 46 API calls 16846->16847 16847->16850 16849 7ff7056847c0 45 API calls 16848->16849 16848->16850 16849->16850 16850->16792 16852 7ff70568a778 _invalid_parameter_noinfo 37 API calls 16851->16852 16853 7ff70568a8f9 16852->16853 16853->16814 16855 7ff7056940ff fegetenv 16854->16855 16856 7ff705697e2c 37 API calls 16855->16856 16861 7ff705694152 16856->16861 16857 7ff70569417f 16860 7ff70568a4a4 __std_exception_copy 37 API calls 16857->16860 16858 7ff705694242 16859 7ff705697e2c 37 API calls 16858->16859 16862 7ff70569426c 16859->16862 16864 7ff7056941fd 16860->16864 16861->16858 16865 7ff70569416d 16861->16865 16866 7ff70569421c 16861->16866 16863 7ff705697e2c 37 API calls 16862->16863 16867 7ff70569427d 16863->16867 16868 7ff705695324 16864->16868 16873 7ff705694205 16864->16873 16865->16857 16865->16858 16869 7ff70568a4a4 __std_exception_copy 37 API calls 16866->16869 16870 7ff705698020 20 API calls 16867->16870 16871 7ff70568a900 _isindst 17 API calls 16868->16871 16869->16864 16881 7ff7056942e6 __scrt_get_show_window_mode 16870->16881 16872 7ff705695339 16871->16872 16874 7ff70567c550 _log10_special 8 API calls 16873->16874 16875 7ff70568e351 16874->16875 16899 7ff705693af4 16875->16899 16876 7ff70569468f __scrt_get_show_window_mode 16877 7ff7056949cf 16878 7ff705693c10 37 API calls 16877->16878 16886 7ff7056950e7 16878->16886 16879 7ff70569497b 16879->16877 16882 7ff70569533c memcpy_s 37 API calls 16879->16882 16880 7ff705694327 memcpy_s 16893 7ff705694c6b memcpy_s __scrt_get_show_window_mode 16880->16893 16894 7ff705694783 memcpy_s __scrt_get_show_window_mode 16880->16894 16881->16876 16881->16880 16883 7ff705684f08 _set_fmode 11 API calls 16881->16883 16882->16877 16884 7ff705694760 16883->16884 16885 7ff70568a8e0 _invalid_parameter_noinfo 37 API calls 16884->16885 16885->16880 16888 7ff70569533c memcpy_s 37 API calls 16886->16888 16892 7ff705695142 16886->16892 16887 7ff7056952c8 16889 7ff705697e2c 37 API calls 16887->16889 16888->16892 16889->16873 16890 7ff705684f08 11 API calls _set_fmode 16890->16893 16891 7ff705684f08 11 API calls _set_fmode 16891->16894 16892->16887 16895 7ff705693c10 37 API calls 16892->16895 16898 7ff70569533c memcpy_s 37 API calls 16892->16898 16893->16877 16893->16879 16893->16890 16896 7ff70568a8e0 37 API calls _invalid_parameter_noinfo 16893->16896 16894->16879 16894->16891 16897 7ff70568a8e0 37 API calls _invalid_parameter_noinfo 16894->16897 16895->16892 16896->16893 16897->16894 16898->16892 16900 7ff705693b13 16899->16900 16901 7ff70568a814 _invalid_parameter_noinfo 37 API calls 16900->16901 16902 7ff705693b3e memcpy_s 16900->16902 16901->16902 16902->16822 16904 7ff70568e1d8 memcpy_s 16903->16904 16905 7ff7056847c0 45 API calls 16904->16905 16906 7ff70568e292 memcpy_s __scrt_get_show_window_mode 16904->16906 16905->16906 16906->16827 16908 7ff70568df2b 16907->16908 16912 7ff70568df78 memcpy_s 16907->16912 16909 7ff70568a814 _invalid_parameter_noinfo 37 API calls 16908->16909 16910 7ff70568df57 16909->16910 16910->16827 16911 7ff70568dfe3 16913 7ff70568a4a4 __std_exception_copy 37 API calls 16911->16913 16912->16911 16914 7ff7056847c0 45 API calls 16912->16914 16917 7ff70568e025 memcpy_s 16913->16917 16914->16911 16915 7ff70568a900 _isindst 17 API calls 16916 7ff70568e0d0 16915->16916 16917->16915 16919 7ff705680c4e 16918->16919 16920 7ff705680c5f 16918->16920 16919->16735 16920->16919 16921 7ff70568d5fc _fread_nolock 12 API calls 16920->16921 16922 7ff705680c90 16921->16922 16923 7ff705680ca4 16922->16923 16924 7ff70568a948 __free_lconv_num 11 API calls 16922->16924 16925 7ff70568a948 __free_lconv_num 11 API calls 16923->16925 16924->16923 16925->16919 16927 7ff705684766 16926->16927 16929 7ff70568476e 16926->16929 16928 7ff7056847c0 45 API calls 16927->16928 16928->16929 16929->16746 16931 7ff70568d9d1 16930->16931 16932 7ff7056847ff 16930->16932 16931->16932 16938 7ff705693304 16931->16938 16934 7ff70568da24 16932->16934 16935 7ff70568480f 16934->16935 16936 7ff70568da3d 16934->16936 16935->16668 16936->16935 16973 7ff705692650 16936->16973 16950 7ff70568b150 GetLastError 16938->16950 16941 7ff70569335e 16941->16932 16951 7ff70568b191 FlsSetValue 16950->16951 16952 7ff70568b174 FlsGetValue 16950->16952 16954 7ff70568b1a3 16951->16954 16955 7ff70568b181 16951->16955 16953 7ff70568b18b 16952->16953 16952->16955 16953->16951 16957 7ff70568eb98 _set_fmode 11 API calls 16954->16957 16956 7ff70568b1fd SetLastError 16955->16956 16958 7ff70568b20a 16956->16958 16959 7ff70568b21d 16956->16959 16960 7ff70568b1b2 16957->16960 16958->16941 16972 7ff7056902d8 EnterCriticalSection 16958->16972 16961 7ff70568a504 __CxxCallCatchBlock 38 API calls 16959->16961 16962 7ff70568b1d0 FlsSetValue 16960->16962 16963 7ff70568b1c0 FlsSetValue 16960->16963 16964 7ff70568b222 16961->16964 16966 7ff70568b1dc FlsSetValue 16962->16966 16967 7ff70568b1ee 16962->16967 16965 7ff70568b1c9 16963->16965 16969 7ff70568a948 __free_lconv_num 11 API calls 16965->16969 16966->16965 16968 7ff70568aef4 _set_fmode 11 API calls 16967->16968 16970 7ff70568b1f6 16968->16970 16969->16955 16971 7ff70568a948 __free_lconv_num 11 API calls 16970->16971 16971->16956 16974 7ff70568b150 __CxxCallCatchBlock 45 API calls 16973->16974 16975 7ff705692659 16974->16975 16982 7ff705696d88 16976->16982 16981 7ff70568f8a9 MultiByteToWideChar 16979->16981 16985 7ff705696dec 16982->16985 16983 7ff70567c550 _log10_special 8 API calls 16984 7ff7056900bd 16983->16984 16984->16770 16985->16983 16987 7ff705680ffd 16986->16987 16988 7ff70568100f 16986->16988 16989 7ff705684f08 _set_fmode 11 API calls 16987->16989 16991 7ff70568101d 16988->16991 16995 7ff705681059 16988->16995 16990 7ff705681002 16989->16990 16992 7ff70568a8e0 _invalid_parameter_noinfo 37 API calls 16990->16992 16993 7ff70568a814 _invalid_parameter_noinfo 37 API calls 16991->16993 17000 7ff70568100d 16992->17000 16993->17000 16994 7ff7056813d5 16996 7ff705684f08 _set_fmode 11 API calls 16994->16996 16994->17000 16995->16994 16997 7ff705684f08 _set_fmode 11 API calls 16995->16997 16998 7ff705681669 16996->16998 16999 7ff7056813ca 16997->16999 17001 7ff70568a8e0 _invalid_parameter_noinfo 37 API calls 16998->17001 17002 7ff70568a8e0 _invalid_parameter_noinfo 37 API calls 16999->17002 17000->16633 17001->17000 17002->16994 17004 7ff705680704 17003->17004 17031 7ff705680464 17004->17031 17006 7ff70568071d 17006->16168 17043 7ff7056803bc 17007->17043 17011 7ff70567c850 17010->17011 17012 7ff705672930 GetCurrentProcessId 17011->17012 17013 7ff705671c80 49 API calls 17012->17013 17014 7ff705672979 17013->17014 17057 7ff705684984 17014->17057 17019 7ff705671c80 49 API calls 17020 7ff7056729ff 17019->17020 17087 7ff705672620 17020->17087 17023 7ff70567c550 _log10_special 8 API calls 17024 7ff705672a31 17023->17024 17024->16178 17026 7ff705671b89 17025->17026 17027 7ff705680119 17025->17027 17026->16178 17026->16207 17028 7ff705684f08 _set_fmode 11 API calls 17027->17028 17029 7ff70568011e 17028->17029 17030 7ff70568a8e0 _invalid_parameter_noinfo 37 API calls 17029->17030 17030->17026 17032 7ff7056804ce 17031->17032 17033 7ff70568048e 17031->17033 17032->17033 17035 7ff7056804da 17032->17035 17034 7ff70568a814 _invalid_parameter_noinfo 37 API calls 17033->17034 17036 7ff7056804b5 17034->17036 17042 7ff70568546c EnterCriticalSection 17035->17042 17036->17006 17044 7ff7056803e6 17043->17044 17055 7ff705671a20 17043->17055 17045 7ff7056803f5 __scrt_get_show_window_mode 17044->17045 17046 7ff705680432 17044->17046 17044->17055 17048 7ff705684f08 _set_fmode 11 API calls 17045->17048 17056 7ff70568546c EnterCriticalSection 17046->17056 17050 7ff70568040a 17048->17050 17052 7ff70568a8e0 _invalid_parameter_noinfo 37 API calls 17050->17052 17052->17055 17055->16175 17055->16176 17058 7ff7056849de 17057->17058 17059 7ff705684a03 17058->17059 17061 7ff705684a3f 17058->17061 17060 7ff70568a814 _invalid_parameter_noinfo 37 API calls 17059->17060 17063 7ff705684a2d 17060->17063 17096 7ff705682c10 17061->17096 17065 7ff70567c550 _log10_special 8 API calls 17063->17065 17064 7ff705684b1c 17066 7ff70568a948 __free_lconv_num 11 API calls 17064->17066 17067 7ff7056729c3 17065->17067 17066->17063 17075 7ff705685160 17067->17075 17069 7ff705684af1 17072 7ff70568a948 __free_lconv_num 11 API calls 17069->17072 17070 7ff705684b40 17070->17064 17071 7ff705684b4a 17070->17071 17074 7ff70568a948 __free_lconv_num 11 API calls 17071->17074 17072->17063 17073 7ff705684ae8 17073->17064 17073->17069 17074->17063 17076 7ff70568b2c8 _set_fmode 11 API calls 17075->17076 17077 7ff705685177 17076->17077 17078 7ff70568eb98 _set_fmode 11 API calls 17077->17078 17080 7ff7056851b7 17077->17080 17084 7ff7056729e5 17077->17084 17079 7ff7056851ac 17078->17079 17081 7ff70568a948 __free_lconv_num 11 API calls 17079->17081 17080->17084 17234 7ff70568ec20 17080->17234 17081->17080 17084->17019 17085 7ff70568a900 _isindst 17 API calls 17086 7ff7056851fc 17085->17086 17088 7ff70567262f 17087->17088 17089 7ff705679390 2 API calls 17088->17089 17090 7ff705672660 17089->17090 17091 7ff705672683 MessageBoxA 17090->17091 17092 7ff70567266f MessageBoxW 17090->17092 17093 7ff705672690 17091->17093 17092->17093 17094 7ff70567c550 _log10_special 8 API calls 17093->17094 17095 7ff7056726a0 17094->17095 17095->17023 17097 7ff705682c4e 17096->17097 17098 7ff705682c3e 17096->17098 17099 7ff705682c57 17097->17099 17100 7ff705682c85 17097->17100 17102 7ff70568a814 _invalid_parameter_noinfo 37 API calls 17098->17102 17103 7ff70568a814 _invalid_parameter_noinfo 37 API calls 17099->17103 17100->17098 17101 7ff705682c7d 17100->17101 17104 7ff7056847c0 45 API calls 17100->17104 17106 7ff705682f34 17100->17106 17110 7ff7056835a0 17100->17110 17136 7ff705683268 17100->17136 17166 7ff705682af0 17100->17166 17101->17064 17101->17069 17101->17070 17101->17073 17102->17101 17103->17101 17104->17100 17108 7ff70568a814 _invalid_parameter_noinfo 37 API calls 17106->17108 17108->17098 17111 7ff705683655 17110->17111 17112 7ff7056835e2 17110->17112 17115 7ff70568365a 17111->17115 17116 7ff7056836af 17111->17116 17113 7ff7056835e8 17112->17113 17114 7ff70568367f 17112->17114 17122 7ff7056835ed 17113->17122 17125 7ff7056836be 17113->17125 17183 7ff705681b50 17114->17183 17117 7ff70568365c 17115->17117 17118 7ff70568368f 17115->17118 17116->17114 17116->17125 17134 7ff705683618 17116->17134 17120 7ff7056835fd 17117->17120 17124 7ff70568366b 17117->17124 17190 7ff705681740 17118->17190 17135 7ff7056836ed 17120->17135 17169 7ff705683f04 17120->17169 17122->17120 17126 7ff705683630 17122->17126 17122->17134 17124->17114 17128 7ff705683670 17124->17128 17125->17135 17197 7ff705681f60 17125->17197 17126->17135 17179 7ff7056843c0 17126->17179 17131 7ff705684558 37 API calls 17128->17131 17128->17135 17130 7ff70567c550 _log10_special 8 API calls 17132 7ff705683983 17130->17132 17131->17134 17132->17100 17134->17135 17204 7ff70568e858 17134->17204 17135->17130 17137 7ff705683289 17136->17137 17138 7ff705683273 17136->17138 17139 7ff70568a814 _invalid_parameter_noinfo 37 API calls 17137->17139 17140 7ff7056832c7 17137->17140 17138->17140 17141 7ff705683655 17138->17141 17142 7ff7056835e2 17138->17142 17139->17140 17140->17100 17145 7ff70568365a 17141->17145 17146 7ff7056836af 17141->17146 17143 7ff7056835e8 17142->17143 17144 7ff70568367f 17142->17144 17153 7ff7056835ed 17143->17153 17156 7ff7056836be 17143->17156 17149 7ff705681b50 38 API calls 17144->17149 17147 7ff70568365c 17145->17147 17148 7ff70568368f 17145->17148 17146->17144 17146->17156 17165 7ff705683618 17146->17165 17150 7ff7056835fd 17147->17150 17154 7ff70568366b 17147->17154 17151 7ff705681740 38 API calls 17148->17151 17149->17165 17152 7ff705683f04 47 API calls 17150->17152 17163 7ff7056836ed 17150->17163 17151->17165 17152->17165 17153->17150 17155 7ff705683630 17153->17155 17153->17165 17154->17144 17158 7ff705683670 17154->17158 17159 7ff7056843c0 47 API calls 17155->17159 17155->17163 17157 7ff705681f60 38 API calls 17156->17157 17156->17163 17157->17165 17161 7ff705684558 37 API calls 17158->17161 17158->17163 17159->17165 17160 7ff70567c550 _log10_special 8 API calls 17162 7ff705683983 17160->17162 17161->17165 17162->17100 17163->17160 17164 7ff70568e858 47 API calls 17164->17165 17165->17163 17165->17164 17217 7ff705680d14 17166->17217 17170 7ff705683f26 17169->17170 17171 7ff705680b80 12 API calls 17170->17171 17172 7ff705683f6e 17171->17172 17173 7ff70568e570 46 API calls 17172->17173 17175 7ff705684041 17173->17175 17174 7ff705684063 17177 7ff7056840ec 17174->17177 17178 7ff7056847c0 45 API calls 17174->17178 17175->17174 17176 7ff7056847c0 45 API calls 17175->17176 17176->17174 17177->17134 17178->17177 17180 7ff7056843d8 17179->17180 17182 7ff705684440 17179->17182 17181 7ff70568e858 47 API calls 17180->17181 17180->17182 17181->17182 17182->17134 17184 7ff705681b83 17183->17184 17185 7ff705681bb2 17184->17185 17187 7ff705681c6f 17184->17187 17186 7ff705680b80 12 API calls 17185->17186 17189 7ff705681bef 17185->17189 17186->17189 17188 7ff70568a814 _invalid_parameter_noinfo 37 API calls 17187->17188 17188->17189 17189->17134 17191 7ff705681773 17190->17191 17192 7ff7056817a2 17191->17192 17194 7ff70568185f 17191->17194 17193 7ff705680b80 12 API calls 17192->17193 17196 7ff7056817df 17192->17196 17193->17196 17195 7ff70568a814 _invalid_parameter_noinfo 37 API calls 17194->17195 17195->17196 17196->17134 17198 7ff705681f93 17197->17198 17199 7ff705681fc2 17198->17199 17201 7ff70568207f 17198->17201 17200 7ff705680b80 12 API calls 17199->17200 17203 7ff705681fff 17199->17203 17200->17203 17202 7ff70568a814 _invalid_parameter_noinfo 37 API calls 17201->17202 17202->17203 17203->17134 17205 7ff70568e880 17204->17205 17206 7ff70568e8c5 17205->17206 17207 7ff70568e885 __scrt_get_show_window_mode 17205->17207 17209 7ff7056847c0 45 API calls 17205->17209 17210 7ff70568e8ae __scrt_get_show_window_mode 17205->17210 17206->17207 17206->17210 17214 7ff7056907e8 17206->17214 17207->17134 17208 7ff70568a814 _invalid_parameter_noinfo 37 API calls 17208->17207 17209->17206 17210->17207 17210->17208 17215 7ff70569080c WideCharToMultiByte 17214->17215 17218 7ff705680d53 17217->17218 17219 7ff705680d41 17217->17219 17222 7ff705680d60 17218->17222 17225 7ff705680d9d 17218->17225 17220 7ff705684f08 _set_fmode 11 API calls 17219->17220 17221 7ff705680d46 17220->17221 17223 7ff70568a8e0 _invalid_parameter_noinfo 37 API calls 17221->17223 17224 7ff70568a814 _invalid_parameter_noinfo 37 API calls 17222->17224 17231 7ff705680d51 17223->17231 17224->17231 17226 7ff705680e46 17225->17226 17227 7ff705684f08 _set_fmode 11 API calls 17225->17227 17228 7ff705684f08 _set_fmode 11 API calls 17226->17228 17226->17231 17229 7ff705680e3b 17227->17229 17230 7ff705680ef0 17228->17230 17232 7ff70568a8e0 _invalid_parameter_noinfo 37 API calls 17229->17232 17233 7ff70568a8e0 _invalid_parameter_noinfo 37 API calls 17230->17233 17231->17100 17232->17226 17233->17231 17239 7ff70568ec3d 17234->17239 17235 7ff70568ec42 17236 7ff7056851dd 17235->17236 17237 7ff705684f08 _set_fmode 11 API calls 17235->17237 17236->17084 17236->17085 17238 7ff70568ec4c 17237->17238 17240 7ff70568a8e0 _invalid_parameter_noinfo 37 API calls 17238->17240 17239->17235 17239->17236 17241 7ff70568ec8c 17239->17241 17240->17236 17241->17236 17242 7ff705684f08 _set_fmode 11 API calls 17241->17242 17242->17238 17244 7ff7056785b1 GetTokenInformation 17243->17244 17246 7ff705678633 __std_exception_destroy 17243->17246 17245 7ff7056785d2 GetLastError 17244->17245 17247 7ff7056785dd 17244->17247 17245->17246 17245->17247 17248 7ff70567864c 17246->17248 17249 7ff705678646 CloseHandle 17246->17249 17247->17246 17250 7ff7056785f9 GetTokenInformation 17247->17250 17248->16225 17249->17248 17250->17246 17251 7ff70567861c 17250->17251 17251->17246 17252 7ff705678626 ConvertSidToStringSidW 17251->17252 17252->17246 17254 7ff70567c850 17253->17254 17255 7ff705672b74 GetCurrentProcessId 17254->17255 17256 7ff7056726b0 48 API calls 17255->17256 17257 7ff705672bc7 17256->17257 17258 7ff705684bd8 48 API calls 17257->17258 17259 7ff705672c10 MessageBoxW 17258->17259 17260 7ff70567c550 _log10_special 8 API calls 17259->17260 17261 7ff705672c40 17260->17261 17261->16235 17263 7ff7056725e5 17262->17263 17264 7ff705684bd8 48 API calls 17263->17264 17265 7ff705672604 17264->17265 17265->16253 17311 7ff705688794 17266->17311 17270 7ff7056781dc 17269->17270 17271 7ff705679390 2 API calls 17270->17271 17272 7ff7056781fb 17271->17272 17273 7ff705678216 ExpandEnvironmentStringsW 17272->17273 17274 7ff705678203 17272->17274 17275 7ff70567823c __std_exception_destroy 17273->17275 17276 7ff705672810 49 API calls 17274->17276 17278 7ff705678253 17275->17278 17279 7ff705678240 17275->17279 17277 7ff70567820f __std_exception_destroy 17276->17277 17281 7ff70567c550 _log10_special 8 API calls 17277->17281 17283 7ff7056782bf 17278->17283 17285 7ff705678261 GetDriveTypeW 17278->17285 17280 7ff705672810 49 API calls 17279->17280 17280->17277 17282 7ff7056783af 17281->17282 17352 7ff705691558 17311->17352 17411 7ff7056912d0 17352->17411 17432 7ff7056902d8 EnterCriticalSection 17411->17432 17559 7ff70567456a 17558->17559 17560 7ff705679390 2 API calls 17559->17560 17561 7ff70567458f 17560->17561 17562 7ff70567c550 _log10_special 8 API calls 17561->17562 17563 7ff7056745b7 17562->17563 17563->16288 17565 7ff705677e2e 17564->17565 17566 7ff705677f52 17565->17566 17567 7ff705671c80 49 API calls 17565->17567 17568 7ff70567c550 _log10_special 8 API calls 17566->17568 17572 7ff705677eb5 17567->17572 17569 7ff705677f83 17568->17569 17569->16288 17570 7ff705671c80 49 API calls 17570->17572 17571 7ff705674560 10 API calls 17571->17572 17572->17566 17572->17570 17572->17571 17573 7ff705679390 2 API calls 17572->17573 17574 7ff705677f23 CreateDirectoryW 17573->17574 17574->17566 17574->17572 17576 7ff705671637 17575->17576 17577 7ff705671613 17575->17577 17579 7ff7056745c0 108 API calls 17576->17579 17696 7ff705671050 17577->17696 17580 7ff70567164b 17579->17580 17582 7ff705671653 17580->17582 17583 7ff705671682 17580->17583 17581 7ff705671618 17584 7ff70567162e 17581->17584 17587 7ff705672710 54 API calls 17581->17587 17585 7ff705684f08 _set_fmode 11 API calls 17582->17585 17586 7ff7056745c0 108 API calls 17583->17586 17584->16288 17588 7ff705671658 17585->17588 17589 7ff705671696 17586->17589 17587->17584 17590 7ff705672910 54 API calls 17588->17590 17591 7ff70567169e 17589->17591 17592 7ff7056716b8 17589->17592 17593 7ff705671671 17590->17593 17594 7ff705672710 54 API calls 17591->17594 17595 7ff7056806d4 73 API calls 17592->17595 17593->16288 17596 7ff7056716ae 17594->17596 17597 7ff7056716cd 17595->17597 17603 7ff70568004c 74 API calls 17596->17603 17598 7ff7056716f9 17597->17598 17599 7ff7056716d1 17597->17599 17606 7ff705671829 17603->17606 17606->16288 17624 7ff70567718b 17623->17624 17626 7ff705677144 17623->17626 17624->16288 17626->17624 17760 7ff705685024 17626->17760 17628 7ff7056741a1 17627->17628 17629 7ff7056744e0 49 API calls 17628->17629 17630 7ff7056741db 17629->17630 17631 7ff7056744e0 49 API calls 17630->17631 17632 7ff7056741eb 17631->17632 17633 7ff70567420d 17632->17633 17634 7ff70567423c 17632->17634 17791 7ff705674110 17633->17791 17635 7ff705674110 51 API calls 17634->17635 17637 7ff70567423a 17635->17637 17638 7ff70567429c 17637->17638 17639 7ff705674267 17637->17639 17641 7ff705674110 51 API calls 17638->17641 17798 7ff705677cf0 17639->17798 17672 7ff705671c80 49 API calls 17671->17672 17673 7ff705674474 17672->17673 17673->16288 17697 7ff7056745c0 108 API calls 17696->17697 17698 7ff70567108c 17697->17698 17699 7ff7056710a9 17698->17699 17700 7ff705671094 17698->17700 17702 7ff7056806d4 73 API calls 17699->17702 17701 7ff705672710 54 API calls 17700->17701 17707 7ff7056710a4 __std_exception_destroy 17701->17707 17703 7ff7056710bf 17702->17703 17704 7ff7056710e6 17703->17704 17705 7ff7056710c3 17703->17705 17710 7ff7056710f7 17704->17710 17711 7ff705671122 17704->17711 17706 7ff705684f08 _set_fmode 11 API calls 17705->17706 17708 7ff7056710c8 17706->17708 17707->17581 17712 7ff705684f08 _set_fmode 11 API calls 17710->17712 17713 7ff705671129 17711->17713 17721 7ff70567113c 17711->17721 17761 7ff70568505e 17760->17761 17762 7ff705685031 17760->17762 17763 7ff705685081 17761->17763 17766 7ff70568509d 17761->17766 17764 7ff705684f08 _set_fmode 11 API calls 17762->17764 17772 7ff705684fe8 17762->17772 17765 7ff705684f08 _set_fmode 11 API calls 17763->17765 17767 7ff70568503b 17764->17767 17768 7ff705685086 17765->17768 17775 7ff705684f4c 17766->17775 17770 7ff70568a8e0 _invalid_parameter_noinfo 37 API calls 17767->17770 17771 7ff70568a8e0 _invalid_parameter_noinfo 37 API calls 17768->17771 17773 7ff705685046 17770->17773 17774 7ff705685091 17771->17774 17772->17626 17773->17626 17774->17626 17776 7ff705684f70 17775->17776 17782 7ff705684f6b 17775->17782 17777 7ff70568b150 __CxxCallCatchBlock 45 API calls 17776->17777 17776->17782 17778 7ff705684f8b 17777->17778 17783 7ff70568d984 17778->17783 17782->17774 17784 7ff705684fae 17783->17784 17785 7ff70568d999 17783->17785 17785->17784 17792 7ff705674136 17791->17792 17793 7ff705684984 49 API calls 17792->17793 17794 7ff70567415c 17793->17794 17795 7ff70567416d 17794->17795 17796 7ff705674560 10 API calls 17794->17796 17795->17637 17855 7ff705685ec8 17854->17855 17856 7ff705685eee 17855->17856 17858 7ff705685f21 17855->17858 17857 7ff705684f08 _set_fmode 11 API calls 17856->17857 17859 7ff705685ef3 17857->17859 17860 7ff705685f27 17858->17860 17861 7ff705685f34 17858->17861 17862 7ff70568a8e0 _invalid_parameter_noinfo 37 API calls 17859->17862 17863 7ff705684f08 _set_fmode 11 API calls 17860->17863 17873 7ff70568ac28 17861->17873 17865 7ff705674616 17862->17865 17863->17865 17865->16313 17886 7ff7056902d8 EnterCriticalSection 17873->17886 18246 7ff7056878f8 18245->18246 18249 7ff7056873d4 18246->18249 18248 7ff705687911 18248->16323 18250 7ff70568741e 18249->18250 18251 7ff7056873ef 18249->18251 18259 7ff70568546c EnterCriticalSection 18250->18259 18253 7ff70568a814 _invalid_parameter_noinfo 37 API calls 18251->18253 18255 7ff70568740f 18253->18255 18255->18248 18261 7ff70567fe43 18260->18261 18262 7ff70567fe71 18260->18262 18263 7ff70568a814 _invalid_parameter_noinfo 37 API calls 18261->18263 18269 7ff70567fe63 18262->18269 18270 7ff70568546c EnterCriticalSection 18262->18270 18263->18269 18269->16327 18272 7ff70567caf2 RtlLookupFunctionEntry 18271->18272 18273 7ff70567cb08 RtlVirtualUnwind 18272->18273 18274 7ff70567c90b 18272->18274 18273->18272 18273->18274 18275 7ff70567c8a0 SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 18274->18275 18277 7ff7056745c0 108 API calls 18276->18277 18278 7ff705671493 18277->18278 18279 7ff70567149b 18278->18279 18280 7ff7056714bc 18278->18280 18281 7ff705672710 54 API calls 18279->18281 18282 7ff7056806d4 73 API calls 18280->18282 18283 7ff7056714ab 18281->18283 18284 7ff7056714d1 18282->18284 18283->16369 18285 7ff7056714f8 18284->18285 18286 7ff7056714d5 18284->18286 18383 7ff705676375 18382->18383 18384 7ff705671c80 49 API calls 18383->18384 18385 7ff7056763b1 18384->18385 18386 7ff7056763dd 18385->18386 18387 7ff7056763ba 18385->18387 18388 7ff705674630 49 API calls 18386->18388 18389 7ff705672710 54 API calls 18387->18389 18391 7ff7056763f5 18388->18391 18390 7ff7056763d3 18389->18390 18395 7ff70567c550 _log10_special 8 API calls 18390->18395 18392 7ff705676413 18391->18392 18393 7ff705672710 54 API calls 18391->18393 18394 7ff705674560 10 API calls 18392->18394 18393->18392 18396 7ff70567641d 18394->18396 18397 7ff70567336e 18395->18397 18398 7ff70567642b 18396->18398 18399 7ff705678e80 3 API calls 18396->18399 18397->16438 18413 7ff705676500 18397->18413 18399->18398 18562 7ff705675400 18413->18562 18564 7ff70567542c 18562->18564 18672 7ff70568b150 __CxxCallCatchBlock 45 API calls 18671->18672 18673 7ff70568a3e1 18672->18673 18676 7ff70568a504 18673->18676 18685 7ff705693650 18676->18685 18711 7ff705693608 18685->18711 18716 7ff7056902d8 EnterCriticalSection 18711->18716 20205 7ff7056916b0 20216 7ff7056973e4 20205->20216 20217 7ff7056973f1 20216->20217 20218 7ff70568a948 __free_lconv_num 11 API calls 20217->20218 20220 7ff70569740d 20217->20220 20218->20217 20219 7ff70568a948 __free_lconv_num 11 API calls 20219->20220 20220->20219 20221 7ff7056916b9 20220->20221 20222 7ff7056902d8 EnterCriticalSection 20221->20222 18773 7ff705685628 18774 7ff705685642 18773->18774 18775 7ff70568565f 18773->18775 18776 7ff705684ee8 _fread_nolock 11 API calls 18774->18776 18775->18774 18777 7ff705685672 CreateFileW 18775->18777 18778 7ff705685647 18776->18778 18779 7ff7056856dc 18777->18779 18780 7ff7056856a6 18777->18780 18782 7ff705684f08 _set_fmode 11 API calls 18778->18782 18824 7ff705685c04 18779->18824 18798 7ff70568577c GetFileType 18780->18798 18785 7ff70568564f 18782->18785 18791 7ff70568a8e0 _invalid_parameter_noinfo 37 API calls 18785->18791 18787 7ff7056856bb CloseHandle 18792 7ff70568565a 18787->18792 18788 7ff7056856d1 CloseHandle 18788->18792 18789 7ff7056856e5 18793 7ff705684e7c _fread_nolock 11 API calls 18789->18793 18790 7ff705685710 18845 7ff7056859c4 18790->18845 18791->18792 18795 7ff7056856ef 18793->18795 18795->18792 18799 7ff7056857ca 18798->18799 18800 7ff705685887 18798->18800 18801 7ff7056857f6 GetFileInformationByHandle 18799->18801 18805 7ff705685b00 21 API calls 18799->18805 18802 7ff7056858b1 18800->18802 18803 7ff70568588f 18800->18803 18806 7ff7056858a2 GetLastError 18801->18806 18807 7ff70568581f 18801->18807 18804 7ff7056858d4 PeekNamedPipe 18802->18804 18822 7ff705685872 18802->18822 18803->18806 18808 7ff705685893 18803->18808 18804->18822 18813 7ff7056857e4 18805->18813 18811 7ff705684e7c _fread_nolock 11 API calls 18806->18811 18809 7ff7056859c4 51 API calls 18807->18809 18810 7ff705684f08 _set_fmode 11 API calls 18808->18810 18814 7ff70568582a 18809->18814 18810->18822 18811->18822 18812 7ff70567c550 _log10_special 8 API calls 18815 7ff7056856b4 18812->18815 18813->18801 18813->18822 18862 7ff705685924 18814->18862 18815->18787 18815->18788 18818 7ff705685924 10 API calls 18819 7ff705685849 18818->18819 18820 7ff705685924 10 API calls 18819->18820 18821 7ff70568585a 18820->18821 18821->18822 18823 7ff705684f08 _set_fmode 11 API calls 18821->18823 18822->18812 18823->18822 18825 7ff705685c3a 18824->18825 18826 7ff705684f08 _set_fmode 11 API calls 18825->18826 18844 7ff705685cd2 __std_exception_destroy 18825->18844 18828 7ff705685c4c 18826->18828 18827 7ff70567c550 _log10_special 8 API calls 18829 7ff7056856e1 18827->18829 18830 7ff705684f08 _set_fmode 11 API calls 18828->18830 18829->18789 18829->18790 18831 7ff705685c54 18830->18831 18832 7ff705687e08 45 API calls 18831->18832 18833 7ff705685c69 18832->18833 18834 7ff705685c7b 18833->18834 18835 7ff705685c71 18833->18835 18837 7ff705684f08 _set_fmode 11 API calls 18834->18837 18836 7ff705684f08 _set_fmode 11 API calls 18835->18836 18840 7ff705685c76 18836->18840 18838 7ff705685c80 18837->18838 18839 7ff705684f08 _set_fmode 11 API calls 18838->18839 18838->18844 18841 7ff705685c8a 18839->18841 18842 7ff705685cc4 GetDriveTypeW 18840->18842 18840->18844 18843 7ff705687e08 45 API calls 18841->18843 18842->18844 18843->18840 18844->18827 18847 7ff7056859ec 18845->18847 18846 7ff70568571d 18855 7ff705685b00 18846->18855 18847->18846 18869 7ff70568f724 18847->18869 18849 7ff705685a80 18849->18846 18850 7ff70568f724 51 API calls 18849->18850 18851 7ff705685a93 18850->18851 18851->18846 18852 7ff70568f724 51 API calls 18851->18852 18853 7ff705685aa6 18852->18853 18853->18846 18854 7ff70568f724 51 API calls 18853->18854 18854->18846 18856 7ff705685b1a 18855->18856 18857 7ff705685b51 18856->18857 18858 7ff705685b2a 18856->18858 18859 7ff70568f5b8 21 API calls 18857->18859 18860 7ff705684e7c _fread_nolock 11 API calls 18858->18860 18861 7ff705685b3a 18858->18861 18859->18861 18860->18861 18861->18795 18863 7ff70568594d FileTimeToSystemTime 18862->18863 18864 7ff705685940 18862->18864 18865 7ff705685961 SystemTimeToTzSpecificLocalTime 18863->18865 18866 7ff705685948 18863->18866 18864->18863 18864->18866 18865->18866 18867 7ff70567c550 _log10_special 8 API calls 18866->18867 18868 7ff705685839 18867->18868 18868->18818 18870 7ff70568f731 18869->18870 18873 7ff70568f755 18869->18873 18871 7ff70568f736 18870->18871 18870->18873 18874 7ff705684f08 _set_fmode 11 API calls 18871->18874 18872 7ff70568f78f 18875 7ff705684f08 _set_fmode 11 API calls 18872->18875 18873->18872 18876 7ff70568f7ae 18873->18876 18877 7ff70568f73b 18874->18877 18878 7ff70568f794 18875->18878 18879 7ff705684f4c 45 API calls 18876->18879 18880 7ff70568a8e0 _invalid_parameter_noinfo 37 API calls 18877->18880 18882 7ff70568a8e0 _invalid_parameter_noinfo 37 API calls 18878->18882 18884 7ff70568f7bb 18879->18884 18881 7ff70568f746 18880->18881 18881->18849 18883 7ff70568f79f 18882->18883 18883->18849 18884->18883 18885 7ff7056904dc 51 API calls 18884->18885 18885->18884 20432 7ff70568c520 20443 7ff7056902d8 EnterCriticalSection 20432->20443

                                                                                                                                                                                                                                                        Executed Functions

                                                                                                                                                                                                                                                        Function 00007FF7056789E0 Relevance: 70.3, APIs: 36, Strings: 4, Instructions: 257synchronizationwindowregistryCOMMON
                                                                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                                                                        control_flow_graph 0 7ff7056789e0-7ff705678b26 call 7ff70567c850 call 7ff705679390 SetConsoleCtrlHandler GetStartupInfoW call 7ff7056853f0 call 7ff70568a47c call 7ff70568871c call 7ff7056853f0 call 7ff70568a47c call 7ff70568871c call 7ff7056853f0 call 7ff70568a47c call 7ff70568871c GetCommandLineW CreateProcessW 23 7ff705678b4d-7ff705678b89 RegisterClassW 0->23 24 7ff705678b28-7ff705678b48 GetLastError call 7ff705672c50 0->24 26 7ff705678b8b GetLastError 23->26 27 7ff705678b91-7ff705678be5 CreateWindowExW 23->27 32 7ff705678e39-7ff705678e5f call 7ff70567c550 24->32 26->27 29 7ff705678be7-7ff705678bed GetLastError 27->29 30 7ff705678bef-7ff705678bf4 ShowWindow 27->30 31 7ff705678bfa-7ff705678c0a WaitForSingleObject 29->31 30->31 33 7ff705678c0c 31->33 34 7ff705678c88-7ff705678c8f 31->34 36 7ff705678c10-7ff705678c13 33->36 37 7ff705678cd2-7ff705678cd9 34->37 38 7ff705678c91-7ff705678ca1 WaitForSingleObject 34->38 40 7ff705678c1b-7ff705678c22 36->40 41 7ff705678c15 GetLastError 36->41 44 7ff705678dc0-7ff705678dd9 GetMessageW 37->44 45 7ff705678cdf-7ff705678cf5 QueryPerformanceFrequency QueryPerformanceCounter 37->45 42 7ff705678df8-7ff705678e02 38->42 43 7ff705678ca7-7ff705678cb7 TerminateProcess 38->43 40->38 47 7ff705678c24-7ff705678c41 PeekMessageW 40->47 41->40 50 7ff705678e04-7ff705678e0a DestroyWindow 42->50 51 7ff705678e11-7ff705678e35 GetExitCodeProcess CloseHandle * 2 42->51 52 7ff705678cb9 GetLastError 43->52 53 7ff705678cbf-7ff705678ccd WaitForSingleObject 43->53 48 7ff705678ddb-7ff705678de9 TranslateMessage DispatchMessageW 44->48 49 7ff705678def-7ff705678df6 44->49 46 7ff705678d00-7ff705678d38 MsgWaitForMultipleObjects PeekMessageW 45->46 54 7ff705678d3a 46->54 55 7ff705678d73-7ff705678d7a 46->55 56 7ff705678c76-7ff705678c86 WaitForSingleObject 47->56 57 7ff705678c43-7ff705678c74 TranslateMessage DispatchMessageW PeekMessageW 47->57 48->49 49->42 49->44 50->51 51->32 52->53 53->42 58 7ff705678d40-7ff705678d71 TranslateMessage DispatchMessageW PeekMessageW 54->58 55->44 59 7ff705678d7c-7ff705678da5 QueryPerformanceCounter 55->59 56->34 56->36 57->56 57->57 58->55 58->58 59->46 60 7ff705678dab-7ff705678db2 59->60 60->42 61 7ff705678db4-7ff705678db8 60->61 61->44
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2506127906.00007FF705671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF705670000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506100994.00007FF705670000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506163767.00007FF70569B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506256106.00007FF7056B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff705670000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: Message$ErrorLast$ObjectProcessSingleWait$CloseCreateHandlePeekWindow_invalid_parameter_noinfo$ByteCharClassCodeCommandConsoleCtrlCurrentDestroyDispatchExitFormatHandlerInfoLineMultiRegisterStartupTerminateTranslateWide
                                                                                                                                                                                                                                                        • String ID: CreateProcessW$Failed to create child process!$PyInstaller Onefile Hidden Window$PyInstallerOnefileHiddenWindow
                                                                                                                                                                                                                                                        • API String ID: 3832162212-3165540532
                                                                                                                                                                                                                                                        • Opcode ID: 99838be411f58a84d89697932930ae4644c798f1dd42cd928399edbb9bf0e48e
                                                                                                                                                                                                                                                        • Instruction ID: d824ddc3fe30b8d0a4a9269047adffe0b9645b6cc4f48489fbd11efc6d3d2908
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 99838be411f58a84d89697932930ae4644c798f1dd42cd928399edbb9bf0e48e
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: EAD16032A08A8686EB10EF34EC542ADB766FF84F58F800235EA5E43AA4DF3CD555C710
                                                                                                                                                                                                                                                        Function 00007FF705671000 Relevance: 61.8, APIs: 7, Strings: 28, Instructions: 511COMMON
                                                                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                                                                        control_flow_graph 62 7ff705671000-7ff705673806 call 7ff70567fe18 call 7ff70567fe20 call 7ff70567c850 call 7ff7056853f0 call 7ff705685484 call 7ff7056736b0 76 7ff705673808-7ff70567380f 62->76 77 7ff705673814-7ff705673836 call 7ff705671950 62->77 78 7ff705673c97-7ff705673cb2 call 7ff70567c550 76->78 83 7ff70567391b-7ff705673931 call 7ff7056745c0 77->83 84 7ff70567383c-7ff705673856 call 7ff705671c80 77->84 89 7ff70567396a-7ff70567397f call 7ff705672710 83->89 90 7ff705673933-7ff705673960 call 7ff705677f90 83->90 88 7ff70567385b-7ff70567389b call 7ff705678830 84->88 97 7ff70567389d-7ff7056738a3 88->97 98 7ff7056738c1-7ff7056738cc call 7ff705684f30 88->98 102 7ff705673c8f 89->102 100 7ff705673984-7ff7056739a6 call 7ff705671c80 90->100 101 7ff705673962-7ff705673965 call 7ff70568004c 90->101 103 7ff7056738a5-7ff7056738ad 97->103 104 7ff7056738af-7ff7056738bd call 7ff7056789a0 97->104 110 7ff7056739fc-7ff705673a2a call 7ff705678940 call 7ff7056789a0 * 3 98->110 111 7ff7056738d2-7ff7056738e1 call 7ff705678830 98->111 115 7ff7056739b0-7ff7056739b9 100->115 101->89 102->78 103->104 104->98 138 7ff705673a2f-7ff705673a3e call 7ff705678830 110->138 119 7ff7056738e7-7ff7056738ed 111->119 120 7ff7056739f4-7ff7056739f7 call 7ff705684f30 111->120 115->115 118 7ff7056739bb-7ff7056739d8 call 7ff705671950 115->118 118->88 127 7ff7056739de-7ff7056739ef call 7ff705672710 118->127 124 7ff7056738f0-7ff7056738fc 119->124 120->110 128 7ff7056738fe-7ff705673903 124->128 129 7ff705673905-7ff705673908 124->129 127->102 128->124 128->129 129->120 132 7ff70567390e-7ff705673916 call 7ff705684f30 129->132 132->138 141 7ff705673b45-7ff705673b53 138->141 142 7ff705673a44-7ff705673a47 138->142 144 7ff705673b59-7ff705673b5d 141->144 145 7ff705673a67 141->145 142->141 143 7ff705673a4d-7ff705673a50 142->143 146 7ff705673a56-7ff705673a5a 143->146 147 7ff705673b14-7ff705673b17 143->147 148 7ff705673a6b-7ff705673a90 call 7ff705684f30 144->148 145->148 146->147 149 7ff705673a60 146->149 150 7ff705673b19-7ff705673b1d 147->150 151 7ff705673b2f-7ff705673b40 call 7ff705672710 147->151 157 7ff705673aab-7ff705673ac0 148->157 158 7ff705673a92-7ff705673aa6 call 7ff705678940 148->158 149->145 150->151 153 7ff705673b1f-7ff705673b2a 150->153 159 7ff705673c7f-7ff705673c87 151->159 153->148 161 7ff705673be8-7ff705673bfa call 7ff705678830 157->161 162 7ff705673ac6-7ff705673aca 157->162 158->157 159->102 170 7ff705673c2e 161->170 171 7ff705673bfc-7ff705673c02 161->171 164 7ff705673bcd-7ff705673be2 call 7ff705671940 162->164 165 7ff705673ad0-7ff705673ae8 call 7ff705685250 162->165 164->161 164->162 176 7ff705673aea-7ff705673b02 call 7ff705685250 165->176 177 7ff705673b62-7ff705673b7a call 7ff705685250 165->177 173 7ff705673c31-7ff705673c40 call 7ff705684f30 170->173 174 7ff705673c1e-7ff705673c2c 171->174 175 7ff705673c04-7ff705673c1c 171->175 185 7ff705673c46-7ff705673c4a 173->185 186 7ff705673d41-7ff705673d63 call 7ff7056744e0 173->186 174->173 175->173 176->164 184 7ff705673b08-7ff705673b0f 176->184 187 7ff705673b7c-7ff705673b80 177->187 188 7ff705673b87-7ff705673b9f call 7ff705685250 177->188 184->164 190 7ff705673cd4-7ff705673ce6 call 7ff705678830 185->190 191 7ff705673c50-7ff705673c5f call 7ff7056790e0 185->191 201 7ff705673d65-7ff705673d6f call 7ff705674630 186->201 202 7ff705673d71-7ff705673d82 call 7ff705671c80 186->202 187->188 197 7ff705673bac-7ff705673bc4 call 7ff705685250 188->197 198 7ff705673ba1-7ff705673ba5 188->198 206 7ff705673ce8-7ff705673ceb 190->206 207 7ff705673d35-7ff705673d3c 190->207 204 7ff705673cb3-7ff705673cb6 call 7ff705678660 191->204 205 7ff705673c61 191->205 197->164 217 7ff705673bc6 197->217 198->197 215 7ff705673d87-7ff705673d96 201->215 202->215 216 7ff705673cbb-7ff705673cbd 204->216 212 7ff705673c68 call 7ff705672710 205->212 206->207 213 7ff705673ced-7ff705673d10 call 7ff705671c80 206->213 207->212 226 7ff705673c6d-7ff705673c77 212->226 230 7ff705673d2b-7ff705673d33 call 7ff705684f30 213->230 231 7ff705673d12-7ff705673d26 call 7ff705672710 call 7ff705684f30 213->231 220 7ff705673d98-7ff705673d9f 215->220 221 7ff705673dc4-7ff705673dda call 7ff705679390 215->221 224 7ff705673cc8-7ff705673ccf 216->224 225 7ff705673cbf-7ff705673cc6 216->225 217->164 220->221 222 7ff705673da1-7ff705673da5 220->222 233 7ff705673ddc 221->233 234 7ff705673de8-7ff705673e04 SetDllDirectoryW 221->234 222->221 228 7ff705673da7-7ff705673dbe SetDllDirectoryW LoadLibraryExW 222->228 224->215 225->212 226->159 228->221 230->215 231->226 233->234 237 7ff705673e0a-7ff705673e19 call 7ff705678830 234->237 238 7ff705673f01-7ff705673f08 234->238 251 7ff705673e1b-7ff705673e21 237->251 252 7ff705673e32-7ff705673e3c call 7ff705684f30 237->252 241 7ff705673f0e-7ff705673f15 238->241 242 7ff705674008-7ff705674010 238->242 241->242 245 7ff705673f1b-7ff705673f25 call 7ff7056733c0 241->245 246 7ff705674035-7ff705674067 call 7ff7056736a0 call 7ff705673360 call 7ff705673670 call 7ff705676fc0 call 7ff705676d70 242->246 247 7ff705674012-7ff70567402f PostMessageW GetMessageW 242->247 245->226 259 7ff705673f2b-7ff705673f3f call 7ff7056790c0 245->259 247->246 255 7ff705673e2d-7ff705673e2f 251->255 256 7ff705673e23-7ff705673e2b 251->256 261 7ff705673ef2-7ff705673efc call 7ff705678940 252->261 262 7ff705673e42-7ff705673e48 252->262 255->252 256->255 271 7ff705673f64-7ff705673fa0 call 7ff705678940 call 7ff7056789e0 call 7ff705676fc0 call 7ff705676d70 call 7ff7056788e0 259->271 272 7ff705673f41-7ff705673f5e PostMessageW GetMessageW 259->272 261->238 262->261 266 7ff705673e4e-7ff705673e54 262->266 269 7ff705673e56-7ff705673e58 266->269 270 7ff705673e5f-7ff705673e61 266->270 274 7ff705673e5a 269->274 275 7ff705673e67-7ff705673e83 call 7ff705676dc0 call 7ff705677340 269->275 270->238 270->275 307 7ff705673fa5-7ff705673fa7 271->307 272->271 274->238 290 7ff705673e8e-7ff705673e95 275->290 291 7ff705673e85-7ff705673e8c 275->291 294 7ff705673e97-7ff705673ea4 call 7ff705676e00 290->294 295 7ff705673eaf-7ff705673eb9 call 7ff7056771b0 290->295 293 7ff705673edb-7ff705673ef0 call 7ff705672a50 call 7ff705676fc0 call 7ff705676d70 291->293 293->238 294->295 304 7ff705673ea6-7ff705673ead 294->304 305 7ff705673ebb-7ff705673ec2 295->305 306 7ff705673ec4-7ff705673ed2 call 7ff7056774f0 295->306 304->293 305->293 306->238 318 7ff705673ed4 306->318 310 7ff705673fa9-7ff705673fbf call 7ff705678ed0 call 7ff7056788e0 307->310 311 7ff705673ff5-7ff705674003 call 7ff705671900 307->311 310->311 323 7ff705673fc1-7ff705673fd6 310->323 311->226 318->293 324 7ff705673fd8-7ff705673feb call 7ff705672710 call 7ff705671900 323->324 325 7ff705673ff0 call 7ff705672a50 323->325 324->226 325->311
                                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2506127906.00007FF705671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF705670000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506100994.00007FF705670000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506163767.00007FF70569B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506256106.00007FF7056B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff705670000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: ErrorFileLastModuleName
                                                                                                                                                                                                                                                        • String ID: Could not create temporary directory!$Could not load PyInstaller's embedded PKG archive from the executable (%s)$Could not side-load PyInstaller's PKG archive from external file (%s)$Failed to convert DLL search path!$Failed to initialize security descriptor for temporary directory!$Failed to load Tcl/Tk shared libraries for splash screen!$Failed to load splash screen resources!$Failed to remove temporary directory: %s$Failed to start splash screen!$Failed to unpack splash screen dependencies from PKG archive!$Invalid value in _PYI_PARENT_PROCESS_LEVEL: %s$MEI$PYINSTALLER_RESET_ENVIRONMENT$PYINSTALLER_STRICT_UNPACK_MODE$PYINSTALLER_SUPPRESS_SPLASH_SCREEN$Path exceeds PYI_PATH_MAX limit.$Py_GIL_DISABLED$VCRUNTIME140.dll$_PYI_APPLICATION_HOME_DIR$_PYI_APPLICATION_HOME_DIR not set for onefile child process!$_PYI_ARCHIVE_FILE$_PYI_PARENT_PROCESS_LEVEL$_PYI_SPLASH_IPC$pkg$pyi-contents-directory$pyi-disable-windowed-traceback$pyi-python-flag$pyi-runtime-tmpdir
                                                                                                                                                                                                                                                        • API String ID: 2776309574-4232158417
                                                                                                                                                                                                                                                        • Opcode ID: 7cdef767cca299725cebb861909846c71d82b2c4b8059a178a3dd349e605a571
                                                                                                                                                                                                                                                        • Instruction ID: 83f831becfef6b6481f955d1c57a9ccdcbc42fbb9931607d0e74e45d3f77a73b
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 7cdef767cca299725cebb861909846c71d82b2c4b8059a178a3dd349e605a571
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: AC328B21B0C68A91FA64FB249C542B9A7A3AF54F80FC44532FA5D433D6EF2CE558D321
                                                                                                                                                                                                                                                        Function 00007FF705695C00 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 334timeCOMMON
                                                                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                                                                        control_flow_graph 479 7ff705695c00-7ff705695c3b call 7ff705695588 call 7ff705695590 call 7ff7056955f8 486 7ff705695c41-7ff705695c4c call 7ff705695598 479->486 487 7ff705695e65-7ff705695eb1 call 7ff70568a900 call 7ff705695588 call 7ff705695590 call 7ff7056955f8 479->487 486->487 492 7ff705695c52-7ff705695c5c 486->492 512 7ff705695fef-7ff70569605d call 7ff70568a900 call 7ff705691578 487->512 513 7ff705695eb7-7ff705695ec2 call 7ff705695598 487->513 494 7ff705695c7e-7ff705695c82 492->494 495 7ff705695c5e-7ff705695c61 492->495 499 7ff705695c85-7ff705695c8d 494->499 497 7ff705695c64-7ff705695c6f 495->497 500 7ff705695c71-7ff705695c78 497->500 501 7ff705695c7a-7ff705695c7c 497->501 499->499 503 7ff705695c8f-7ff705695ca2 call 7ff70568d5fc 499->503 500->497 500->501 501->494 505 7ff705695cab-7ff705695cb9 501->505 510 7ff705695ca4-7ff705695ca6 call 7ff70568a948 503->510 511 7ff705695cba-7ff705695cc6 call 7ff70568a948 503->511 510->505 521 7ff705695ccd-7ff705695cd5 511->521 532 7ff70569605f-7ff705696066 512->532 533 7ff70569606b-7ff70569606e 512->533 513->512 522 7ff705695ec8-7ff705695ed3 call 7ff7056955c8 513->522 521->521 524 7ff705695cd7-7ff705695ce8 call 7ff705690474 521->524 522->512 531 7ff705695ed9-7ff705695efc call 7ff70568a948 GetTimeZoneInformation 522->531 524->487 534 7ff705695cee-7ff705695d44 call 7ff70569a4d0 * 4 call 7ff705695b1c 524->534 548 7ff705695f02-7ff705695f23 531->548 549 7ff705695fc4-7ff705695fee call 7ff705695580 call 7ff705695570 call 7ff705695578 531->549 538 7ff7056960fb-7ff7056960fe 532->538 535 7ff705696070 533->535 536 7ff7056960a5-7ff7056960b8 call 7ff70568d5fc 533->536 592 7ff705695d46-7ff705695d4a 534->592 540 7ff705696073 535->540 552 7ff7056960c3-7ff7056960de call 7ff705691578 536->552 553 7ff7056960ba 536->553 538->540 541 7ff705696104-7ff70569610c call 7ff705695c00 538->541 546 7ff705696078-7ff7056960a4 call 7ff70568a948 call 7ff70567c550 540->546 547 7ff705696073 call 7ff705695e7c 540->547 541->546 547->546 555 7ff705695f25-7ff705695f2b 548->555 556 7ff705695f2e-7ff705695f35 548->556 578 7ff7056960e0-7ff7056960e3 552->578 579 7ff7056960e5-7ff7056960f7 call 7ff70568a948 552->579 561 7ff7056960bc-7ff7056960c1 call 7ff70568a948 553->561 555->556 563 7ff705695f37-7ff705695f3f 556->563 564 7ff705695f49 556->564 561->535 563->564 572 7ff705695f41-7ff705695f47 563->572 570 7ff705695f4b-7ff705695fbf call 7ff70569a4d0 * 4 call 7ff705692b5c call 7ff705696114 * 2 564->570 570->549 572->570 578->561 579->538 594 7ff705695d50-7ff705695d54 592->594 595 7ff705695d4c 592->595 594->592 597 7ff705695d56-7ff705695d7b call 7ff705686b58 594->597 595->594 603 7ff705695d7e-7ff705695d82 597->603 605 7ff705695d91-7ff705695d95 603->605 606 7ff705695d84-7ff705695d8f 603->606 605->603 606->605 608 7ff705695d97-7ff705695d9b 606->608 609 7ff705695e1c-7ff705695e20 608->609 610 7ff705695d9d-7ff705695dc5 call 7ff705686b58 608->610 613 7ff705695e22-7ff705695e24 609->613 614 7ff705695e27-7ff705695e34 609->614 619 7ff705695de3-7ff705695de7 610->619 620 7ff705695dc7 610->620 613->614 615 7ff705695e4f-7ff705695e5e call 7ff705695580 call 7ff705695570 614->615 616 7ff705695e36-7ff705695e4c call 7ff705695b1c 614->616 615->487 616->615 619->609 625 7ff705695de9-7ff705695e07 call 7ff705686b58 619->625 623 7ff705695dca-7ff705695dd1 620->623 623->619 626 7ff705695dd3-7ff705695de1 623->626 631 7ff705695e13-7ff705695e1a 625->631 626->619 626->623 631->609 632 7ff705695e09-7ff705695e0d 631->632 632->609 633 7ff705695e0f 632->633 633->631
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        • _get_daylight.LIBCMT ref: 00007FF705695C45
                                                                                                                                                                                                                                                          • Part of subcall function 00007FF705695598: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7056955AC
                                                                                                                                                                                                                                                          • Part of subcall function 00007FF70568A948: RtlFreeHeap.NTDLL(?,?,?,00007FF705692D22,?,?,?,00007FF705692D5F,?,?,00000000,00007FF705693225,?,?,?,00007FF705693157), ref: 00007FF70568A95E
                                                                                                                                                                                                                                                          • Part of subcall function 00007FF70568A948: GetLastError.KERNEL32(?,?,?,00007FF705692D22,?,?,?,00007FF705692D5F,?,?,00000000,00007FF705693225,?,?,?,00007FF705693157), ref: 00007FF70568A968
                                                                                                                                                                                                                                                          • Part of subcall function 00007FF70568A900: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF70568A8DF,?,?,?,?,?,00007FF70568A7CA), ref: 00007FF70568A909
                                                                                                                                                                                                                                                          • Part of subcall function 00007FF70568A900: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF70568A8DF,?,?,?,?,?,00007FF70568A7CA), ref: 00007FF70568A92E
                                                                                                                                                                                                                                                        • _get_daylight.LIBCMT ref: 00007FF705695C34
                                                                                                                                                                                                                                                          • Part of subcall function 00007FF7056955F8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF70569560C
                                                                                                                                                                                                                                                        • _get_daylight.LIBCMT ref: 00007FF705695EAA
                                                                                                                                                                                                                                                        • _get_daylight.LIBCMT ref: 00007FF705695EBB
                                                                                                                                                                                                                                                        • _get_daylight.LIBCMT ref: 00007FF705695ECC
                                                                                                                                                                                                                                                        • GetTimeZoneInformation.KERNELBASE(?,?,?,?,?,?,?,?,?,00000000,?,00007FF70569610C), ref: 00007FF705695EF3
                                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2506127906.00007FF705671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF705670000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506100994.00007FF705670000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506163767.00007FF70569B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506256106.00007FF7056B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff705670000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: _get_daylight$_invalid_parameter_noinfo$CurrentErrorFeatureFreeHeapInformationLastPresentProcessProcessorTimeZone
                                                                                                                                                                                                                                                        • String ID: Eastern Standard Time$Eastern Summer Time
                                                                                                                                                                                                                                                        • API String ID: 4070488512-239921721
                                                                                                                                                                                                                                                        • Opcode ID: c8e181fbda5929fcc8f6a75e148055e791a7ddaa32984997676ab034941af52a
                                                                                                                                                                                                                                                        • Instruction ID: 588d566cc836f32067e25e7bb1aa203e4e4b4ef7ffadb6dd265d4df96a481717
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: c8e181fbda5929fcc8f6a75e148055e791a7ddaa32984997676ab034941af52a
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 31D1AE32B1824286EB21BF25DC511B9A366EFA4F94FC48176FA0E47696DF3CE441C760
                                                                                                                                                                                                                                                        Function 00007FF705696964 Relevance: 13.8, APIs: 9, Instructions: 276fileCOMMON
                                                                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                                                                        control_flow_graph 693 7ff705696964-7ff7056969d7 call 7ff705696698 696 7ff7056969f1-7ff7056969fb call 7ff705688520 693->696 697 7ff7056969d9-7ff7056969e2 call 7ff705684ee8 693->697 702 7ff705696a16-7ff705696a7f CreateFileW 696->702 703 7ff7056969fd-7ff705696a14 call 7ff705684ee8 call 7ff705684f08 696->703 704 7ff7056969e5-7ff7056969ec call 7ff705684f08 697->704 706 7ff705696a81-7ff705696a87 702->706 707 7ff705696afc-7ff705696b07 GetFileType 702->707 703->704 721 7ff705696d32-7ff705696d52 704->721 710 7ff705696ac9-7ff705696af7 GetLastError call 7ff705684e7c 706->710 711 7ff705696a89-7ff705696a8d 706->711 713 7ff705696b09-7ff705696b44 GetLastError call 7ff705684e7c CloseHandle 707->713 714 7ff705696b5a-7ff705696b61 707->714 710->704 711->710 719 7ff705696a8f-7ff705696ac7 CreateFileW 711->719 713->704 727 7ff705696b4a-7ff705696b55 call 7ff705684f08 713->727 717 7ff705696b63-7ff705696b67 714->717 718 7ff705696b69-7ff705696b6c 714->718 724 7ff705696b72-7ff705696bc7 call 7ff705688438 717->724 718->724 725 7ff705696b6e 718->725 719->707 719->710 732 7ff705696be6-7ff705696c17 call 7ff705696418 724->732 733 7ff705696bc9-7ff705696bd5 call 7ff7056968a0 724->733 725->724 727->704 738 7ff705696c19-7ff705696c1b 732->738 739 7ff705696c1d-7ff705696c5f 732->739 733->732 740 7ff705696bd7 733->740 741 7ff705696bd9-7ff705696be1 call 7ff70568aac0 738->741 742 7ff705696c81-7ff705696c8c 739->742 743 7ff705696c61-7ff705696c65 739->743 740->741 741->721 746 7ff705696d30 742->746 747 7ff705696c92-7ff705696c96 742->747 743->742 745 7ff705696c67-7ff705696c7c 743->745 745->742 746->721 747->746 749 7ff705696c9c-7ff705696ce1 CloseHandle CreateFileW 747->749 750 7ff705696ce3-7ff705696d11 GetLastError call 7ff705684e7c call 7ff705688660 749->750 751 7ff705696d16-7ff705696d2b 749->751 750->751 751->746
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2506127906.00007FF705671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF705670000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506100994.00007FF705670000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506163767.00007FF70569B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506256106.00007FF7056B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff705670000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
                                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                                        • API String ID: 1617910340-0
                                                                                                                                                                                                                                                        • Opcode ID: baaa1bd2bfcf3e8d87424e6061cd652f961a4b3dae6ad7eaae94581ee29caa63
                                                                                                                                                                                                                                                        • Instruction ID: ff88776364ad27a5742740cd4cde8a583f77c1cb5f97e236fa27ad49672b4301
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: baaa1bd2bfcf3e8d87424e6061cd652f961a4b3dae6ad7eaae94581ee29caa63
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: DBC1C036B28A4285EB10EF65D8906BC7766FB89F98B810235EE2E5B794DF38D055C310
                                                                                                                                                                                                                                                        Function 00007FF7056783C0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 89fileCOMMON
                                                                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        • FindFirstFileW.KERNELBASE(?,00007FF705678919,00007FF705673FA5), ref: 00007FF70567842B
                                                                                                                                                                                                                                                        • RemoveDirectoryW.KERNEL32(?,00007FF705678919,00007FF705673FA5), ref: 00007FF7056784AE
                                                                                                                                                                                                                                                        • DeleteFileW.KERNELBASE(?,00007FF705678919,00007FF705673FA5), ref: 00007FF7056784CD
                                                                                                                                                                                                                                                        • FindNextFileW.KERNELBASE(?,00007FF705678919,00007FF705673FA5), ref: 00007FF7056784DB
                                                                                                                                                                                                                                                        • FindClose.KERNEL32(?,00007FF705678919,00007FF705673FA5), ref: 00007FF7056784EC
                                                                                                                                                                                                                                                        • RemoveDirectoryW.KERNELBASE(?,00007FF705678919,00007FF705673FA5), ref: 00007FF7056784F5
                                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2506127906.00007FF705671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF705670000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506100994.00007FF705670000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506163767.00007FF70569B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506256106.00007FF7056B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff705670000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: FileFind$DirectoryRemove$CloseDeleteFirstNext
                                                                                                                                                                                                                                                        • String ID: %s\*
                                                                                                                                                                                                                                                        • API String ID: 1057558799-766152087
                                                                                                                                                                                                                                                        • Opcode ID: 9215641a051a597ab69d89bbe09b444c24fb25eba6eed844fe9e008ab190e420
                                                                                                                                                                                                                                                        • Instruction ID: 69f235c666869d0774833ae8cfea669711e75b2dbda4890cb40ba9b2c34572d9
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 9215641a051a597ab69d89bbe09b444c24fb25eba6eed844fe9e008ab190e420
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: AC416021A0C54A85EA60FB24E8581BAA366FF94F54FD00332FA9D436D8EF7CD9458760
                                                                                                                                                                                                                                                        Function 00007FF705695E7C Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 143timeCOMMON
                                                                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                                                                        control_flow_graph 1014 7ff705695e7c-7ff705695eb1 call 7ff705695588 call 7ff705695590 call 7ff7056955f8 1021 7ff705695fef-7ff70569605d call 7ff70568a900 call 7ff705691578 1014->1021 1022 7ff705695eb7-7ff705695ec2 call 7ff705695598 1014->1022 1034 7ff70569605f-7ff705696066 1021->1034 1035 7ff70569606b-7ff70569606e 1021->1035 1022->1021 1027 7ff705695ec8-7ff705695ed3 call 7ff7056955c8 1022->1027 1027->1021 1033 7ff705695ed9-7ff705695efc call 7ff70568a948 GetTimeZoneInformation 1027->1033 1047 7ff705695f02-7ff705695f23 1033->1047 1048 7ff705695fc4-7ff705695fee call 7ff705695580 call 7ff705695570 call 7ff705695578 1033->1048 1039 7ff7056960fb-7ff7056960fe 1034->1039 1036 7ff705696070 1035->1036 1037 7ff7056960a5-7ff7056960b8 call 7ff70568d5fc 1035->1037 1040 7ff705696073 1036->1040 1050 7ff7056960c3-7ff7056960de call 7ff705691578 1037->1050 1051 7ff7056960ba 1037->1051 1039->1040 1041 7ff705696104-7ff70569610c call 7ff705695c00 1039->1041 1045 7ff705696078-7ff7056960a4 call 7ff70568a948 call 7ff70567c550 1040->1045 1046 7ff705696073 call 7ff705695e7c 1040->1046 1041->1045 1046->1045 1053 7ff705695f25-7ff705695f2b 1047->1053 1054 7ff705695f2e-7ff705695f35 1047->1054 1072 7ff7056960e0-7ff7056960e3 1050->1072 1073 7ff7056960e5-7ff7056960f7 call 7ff70568a948 1050->1073 1057 7ff7056960bc-7ff7056960c1 call 7ff70568a948 1051->1057 1053->1054 1059 7ff705695f37-7ff705695f3f 1054->1059 1060 7ff705695f49 1054->1060 1057->1036 1059->1060 1067 7ff705695f41-7ff705695f47 1059->1067 1065 7ff705695f4b-7ff705695fbf call 7ff70569a4d0 * 4 call 7ff705692b5c call 7ff705696114 * 2 1060->1065 1065->1048 1067->1065 1072->1057 1073->1039
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        • _get_daylight.LIBCMT ref: 00007FF705695EAA
                                                                                                                                                                                                                                                          • Part of subcall function 00007FF7056955F8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF70569560C
                                                                                                                                                                                                                                                        • _get_daylight.LIBCMT ref: 00007FF705695EBB
                                                                                                                                                                                                                                                          • Part of subcall function 00007FF705695598: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7056955AC
                                                                                                                                                                                                                                                        • _get_daylight.LIBCMT ref: 00007FF705695ECC
                                                                                                                                                                                                                                                          • Part of subcall function 00007FF7056955C8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7056955DC
                                                                                                                                                                                                                                                          • Part of subcall function 00007FF70568A948: RtlFreeHeap.NTDLL(?,?,?,00007FF705692D22,?,?,?,00007FF705692D5F,?,?,00000000,00007FF705693225,?,?,?,00007FF705693157), ref: 00007FF70568A95E
                                                                                                                                                                                                                                                          • Part of subcall function 00007FF70568A948: GetLastError.KERNEL32(?,?,?,00007FF705692D22,?,?,?,00007FF705692D5F,?,?,00000000,00007FF705693225,?,?,?,00007FF705693157), ref: 00007FF70568A968
                                                                                                                                                                                                                                                        • GetTimeZoneInformation.KERNELBASE(?,?,?,?,?,?,?,?,?,00000000,?,00007FF70569610C), ref: 00007FF705695EF3
                                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2506127906.00007FF705671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF705670000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506100994.00007FF705670000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506163767.00007FF70569B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506256106.00007FF7056B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff705670000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: _get_daylight_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
                                                                                                                                                                                                                                                        • String ID: Eastern Standard Time$Eastern Summer Time
                                                                                                                                                                                                                                                        • API String ID: 3458911817-239921721
                                                                                                                                                                                                                                                        • Opcode ID: 6f2171165b001c2744b9d494c76d2a7753c36df5ed5d67f3075860c83c0dbe14
                                                                                                                                                                                                                                                        • Instruction ID: 4a3070a30bc8aadaadb64fd45806d1b6365a3252030cebb5226b923f78412b96
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 6f2171165b001c2744b9d494c76d2a7753c36df5ed5d67f3075860c83c0dbe14
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 64518B32B1864286E720FF25DC815A9A366BF58F84FC08176FA0E43796DF3CE4408B60
                                                                                                                                                                                                                                                        Function 00007FF705679280 Relevance: 3.0, APIs: 2, Instructions: 29COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2506127906.00007FF705671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF705670000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506100994.00007FF705670000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506163767.00007FF70569B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506256106.00007FF7056B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff705670000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: Find$CloseFileFirst
                                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                                        • API String ID: 2295610775-0
                                                                                                                                                                                                                                                        • Opcode ID: 3849ca1beccae91a12aeced599bc73bdbec409d6dd090ca7d2ec6d5d284a4285
                                                                                                                                                                                                                                                        • Instruction ID: 419a5a7ab0bc67f9544b49b320e0005f404720022893c58a178436e1d8ed0595
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 3849ca1beccae91a12aeced599bc73bdbec409d6dd090ca7d2ec6d5d284a4285
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: C5F0C822A1C74586F770EB60B898766B391AF84F24F840336E97D026D4DF3CD059CB00
                                                                                                                                                                                                                                                        Function 00007FF7056908C8 Relevance: 2.0, APIs: 1, Instructions: 461COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2506127906.00007FF705671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF705670000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506100994.00007FF705670000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506163767.00007FF70569B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506256106.00007FF7056B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff705670000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: CurrentFeaturePresentProcessProcessor
                                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                                        • API String ID: 1010374628-0
                                                                                                                                                                                                                                                        • Opcode ID: 537422541fbed36a77ddee3a41e978a3695e14332b64c7d8d0a2d6c09592a1ae
                                                                                                                                                                                                                                                        • Instruction ID: 00de51fa9a5b5ba75571edf324a50f37d977f9e8121acd480339fdb534a3a20a
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 537422541fbed36a77ddee3a41e978a3695e14332b64c7d8d0a2d6c09592a1ae
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: BF02CA21A1E64381FE65BB229C18279E68AAF45FB0FC58675FD6D463D2DF3CA4418320
                                                                                                                                                                                                                                                        Function 00007FF705671950 Relevance: 22.9, APIs: 2, Strings: 11, Instructions: 184COMMON
                                                                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                                                                        control_flow_graph 331 7ff705671950-7ff70567198b call 7ff7056745c0 334 7ff705671c4e-7ff705671c72 call 7ff70567c550 331->334 335 7ff705671991-7ff7056719d1 call 7ff705677f90 331->335 340 7ff705671c3b-7ff705671c3e call 7ff70568004c 335->340 341 7ff7056719d7-7ff7056719e7 call 7ff7056806d4 335->341 345 7ff705671c43-7ff705671c4b 340->345 346 7ff7056719e9-7ff705671a03 call 7ff705684f08 call 7ff705672910 341->346 347 7ff705671a08-7ff705671a24 call 7ff70568039c 341->347 345->334 346->340 352 7ff705671a45-7ff705671a5a call 7ff705684f28 347->352 353 7ff705671a26-7ff705671a40 call 7ff705684f08 call 7ff705672910 347->353 361 7ff705671a7b-7ff705671b05 call 7ff705671c80 * 2 call 7ff7056806d4 call 7ff705684f44 352->361 362 7ff705671a5c-7ff705671a76 call 7ff705684f08 call 7ff705672910 352->362 353->340 375 7ff705671b0a-7ff705671b14 361->375 362->340 376 7ff705671b35-7ff705671b4e call 7ff70568039c 375->376 377 7ff705671b16-7ff705671b30 call 7ff705684f08 call 7ff705672910 375->377 382 7ff705671b6f-7ff705671b8b call 7ff705680110 376->382 383 7ff705671b50-7ff705671b6a call 7ff705684f08 call 7ff705672910 376->383 377->340 391 7ff705671b8d-7ff705671b99 call 7ff705672710 382->391 392 7ff705671b9e-7ff705671bac 382->392 383->340 391->340 392->340 395 7ff705671bb2-7ff705671bb9 392->395 397 7ff705671bc1-7ff705671bc7 395->397 398 7ff705671bc9-7ff705671bd6 397->398 399 7ff705671be0-7ff705671bef 397->399 400 7ff705671bf1-7ff705671bfa 398->400 399->399 399->400 401 7ff705671bfc-7ff705671bff 400->401 402 7ff705671c0f 400->402 401->402 403 7ff705671c01-7ff705671c04 401->403 404 7ff705671c11-7ff705671c24 402->404 403->402 405 7ff705671c06-7ff705671c09 403->405 406 7ff705671c2d-7ff705671c39 404->406 407 7ff705671c26 404->407 405->402 408 7ff705671c0b-7ff705671c0d 405->408 406->340 406->397 407->406 408->404
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                          • Part of subcall function 00007FF705677F90: _fread_nolock.LIBCMT ref: 00007FF70567803A
                                                                                                                                                                                                                                                        • _fread_nolock.LIBCMT ref: 00007FF705671A1B
                                                                                                                                                                                                                                                          • Part of subcall function 00007FF705672910: GetCurrentProcessId.KERNEL32(?,?,?,?,00000000,00000000,?,00000000,00007FF705671B6A), ref: 00007FF70567295E
                                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2506127906.00007FF705671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF705670000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506100994.00007FF705670000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506163767.00007FF70569B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506256106.00007FF7056B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff705670000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: _fread_nolock$CurrentProcess
                                                                                                                                                                                                                                                        • String ID: Could not allocate buffer for TOC!$Could not allocate memory for archive structure!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$MEI$calloc$fread$fseek$malloc
                                                                                                                                                                                                                                                        • API String ID: 2397952137-3497178890
                                                                                                                                                                                                                                                        • Opcode ID: 75df882cb69919a76d97c614361eef51b2ec2ab8d5059f73c2ac4bb1c74e6529
                                                                                                                                                                                                                                                        • Instruction ID: b6f1f3151d4f89d4bd5e28d56cf60d2f09c310571f0b6e4c8080e92d2e017d9b
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 75df882cb69919a76d97c614361eef51b2ec2ab8d5059f73c2ac4bb1c74e6529
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: D681D571A0C68A86EB60EB24E8402B9B392EF85F44FC04536F94D43795DF3CE585C720
                                                                                                                                                                                                                                                        Function 00007FF705671600 Relevance: 22.9, APIs: 1, Strings: 12, Instructions: 145COMMON
                                                                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                                                                        control_flow_graph 409 7ff705671600-7ff705671611 410 7ff705671637-7ff705671651 call 7ff7056745c0 409->410 411 7ff705671613-7ff70567161c call 7ff705671050 409->411 416 7ff705671653-7ff705671681 call 7ff705684f08 call 7ff705672910 410->416 417 7ff705671682-7ff70567169c call 7ff7056745c0 410->417 418 7ff70567162e-7ff705671636 411->418 419 7ff70567161e-7ff705671629 call 7ff705672710 411->419 426 7ff70567169e-7ff7056716b3 call 7ff705672710 417->426 427 7ff7056716b8-7ff7056716cf call 7ff7056806d4 417->427 419->418 433 7ff705671821-7ff705671824 call 7ff70568004c 426->433 434 7ff7056716f9-7ff7056716fd 427->434 435 7ff7056716d1-7ff7056716f4 call 7ff705684f08 call 7ff705672910 427->435 443 7ff705671829-7ff70567183b 433->443 437 7ff705671717-7ff705671737 call 7ff705684f44 434->437 438 7ff7056716ff-7ff70567170b call 7ff705671210 434->438 448 7ff705671819-7ff70567181c call 7ff70568004c 435->448 449 7ff705671739-7ff70567175c call 7ff705684f08 call 7ff705672910 437->449 450 7ff705671761-7ff70567176c 437->450 445 7ff705671710-7ff705671712 438->445 445->448 448->433 462 7ff70567180f-7ff705671814 449->462 451 7ff705671802-7ff70567180a call 7ff705684f30 450->451 452 7ff705671772-7ff705671777 450->452 451->462 455 7ff705671780-7ff7056717a2 call 7ff70568039c 452->455 464 7ff7056717da-7ff7056717e6 call 7ff705684f08 455->464 465 7ff7056717a4-7ff7056717bc call 7ff705680adc 455->465 462->448 470 7ff7056717ed-7ff7056717f8 call 7ff705672910 464->470 471 7ff7056717be-7ff7056717c1 465->471 472 7ff7056717c5-7ff7056717d8 call 7ff705684f08 465->472 477 7ff7056717fd 470->477 471->455 474 7ff7056717c3 471->474 472->470 474->477 477->451
                                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2506127906.00007FF705671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF705670000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506100994.00007FF705670000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506163767.00007FF70569B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506256106.00007FF7056B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff705670000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: CurrentProcess
                                                                                                                                                                                                                                                        • String ID: Failed to create symbolic link %s!$Failed to extract %s: failed to allocate temporary buffer!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to open target file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$Failed to extract %s: failed to write data chunk!$fopen$fread$fseek$fwrite$malloc
                                                                                                                                                                                                                                                        • API String ID: 2050909247-1550345328
                                                                                                                                                                                                                                                        • Opcode ID: d7e5a8d788c56064f5ee056adac7b7af7416d0cf868ad80b96a324f46d3978b4
                                                                                                                                                                                                                                                        • Instruction ID: c4e88187d4644093657472a279d60ae714d948d0a4428b51833fac19296ad5f6
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: d7e5a8d788c56064f5ee056adac7b7af7416d0cf868ad80b96a324f46d3978b4
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 9E519F21B0864B92EA10FB11AC501B9A396BF85F94FD44636FE1C077A6EF3CE585C720
                                                                                                                                                                                                                                                        Function 00007FF705678660 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 116COMMON
                                                                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        • GetTempPathW.KERNEL32(?,?,00000000,00007FF705673CBB), ref: 00007FF705678704
                                                                                                                                                                                                                                                        • GetCurrentProcessId.KERNEL32(?,00000000,00007FF705673CBB), ref: 00007FF70567870A
                                                                                                                                                                                                                                                        • CreateDirectoryW.KERNELBASE(?,00000000,00007FF705673CBB), ref: 00007FF70567874C
                                                                                                                                                                                                                                                          • Part of subcall function 00007FF705678830: GetEnvironmentVariableW.KERNEL32(00007FF70567388E), ref: 00007FF705678867
                                                                                                                                                                                                                                                          • Part of subcall function 00007FF705678830: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF705678889
                                                                                                                                                                                                                                                          • Part of subcall function 00007FF705688238: _invalid_parameter_noinfo.LIBCMT ref: 00007FF705688251
                                                                                                                                                                                                                                                          • Part of subcall function 00007FF705672810: MessageBoxW.USER32 ref: 00007FF7056728EA
                                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2506127906.00007FF705671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF705670000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506100994.00007FF705670000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506163767.00007FF70569B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506256106.00007FF7056B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff705670000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: Environment$CreateCurrentDirectoryExpandMessagePathProcessStringsTempVariable_invalid_parameter_noinfo
                                                                                                                                                                                                                                                        • String ID: LOADER: failed to set the TMP environment variable.$LOADER: length of teporary directory path exceeds maximum path length!$TMP$TMP$_MEI%d
                                                                                                                                                                                                                                                        • API String ID: 3563477958-1339014028
                                                                                                                                                                                                                                                        • Opcode ID: 191653d34e5a06968e8282251bef030903df87164e49fe651f79a53b4d97858f
                                                                                                                                                                                                                                                        • Instruction ID: a62dd1833040e2c592170179cf0bd26ee9554cdadf44b1c133fb0773274b5fa5
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 191653d34e5a06968e8282251bef030903df87164e49fe651f79a53b4d97858f
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 71419F21A1964684FA60F761AD692B99397AF84FC4FC04131FD0E5779AEF3CE9418360
                                                                                                                                                                                                                                                        Function 00007FF705671210 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 158COMMON
                                                                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                                                                        control_flow_graph 756 7ff705671210-7ff70567126d call 7ff70567bd80 759 7ff705671297-7ff7056712af call 7ff705684f44 756->759 760 7ff70567126f-7ff705671296 call 7ff705672710 756->760 765 7ff7056712d4-7ff7056712e4 call 7ff705684f44 759->765 766 7ff7056712b1-7ff7056712cf call 7ff705684f08 call 7ff705672910 759->766 772 7ff705671309-7ff70567131b 765->772 773 7ff7056712e6-7ff705671304 call 7ff705684f08 call 7ff705672910 765->773 778 7ff705671439-7ff70567144e call 7ff70567ba60 call 7ff705684f30 * 2 766->778 774 7ff705671320-7ff705671345 call 7ff70568039c 772->774 773->778 784 7ff70567134b-7ff705671355 call 7ff705680110 774->784 785 7ff705671431 774->785 793 7ff705671453-7ff70567146d 778->793 784->785 792 7ff70567135b-7ff705671367 784->792 785->778 794 7ff705671370-7ff705671398 call 7ff70567a1c0 792->794 797 7ff70567139a-7ff70567139d 794->797 798 7ff705671416-7ff70567142c call 7ff705672710 794->798 799 7ff705671411 797->799 800 7ff70567139f-7ff7056713a9 797->800 798->785 799->798 802 7ff7056713ab-7ff7056713b9 call 7ff705680adc 800->802 803 7ff7056713d4-7ff7056713d7 800->803 809 7ff7056713be-7ff7056713c1 802->809 804 7ff7056713d9-7ff7056713e7 call 7ff705699e30 803->804 805 7ff7056713ea-7ff7056713ef 803->805 804->805 805->794 808 7ff7056713f5-7ff7056713f8 805->808 813 7ff70567140c-7ff70567140f 808->813 814 7ff7056713fa-7ff7056713fd 808->814 810 7ff7056713c3-7ff7056713cd call 7ff705680110 809->810 811 7ff7056713cf-7ff7056713d2 809->811 810->805 810->811 811->798 813->785 814->798 816 7ff7056713ff-7ff705671407 814->816 816->774
                                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2506127906.00007FF705671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF705670000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506100994.00007FF705670000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506163767.00007FF70569B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506256106.00007FF7056B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff705670000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: CurrentProcess
                                                                                                                                                                                                                                                        • String ID: 1.3.1$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$malloc
                                                                                                                                                                                                                                                        • API String ID: 2050909247-2813020118
                                                                                                                                                                                                                                                        • Opcode ID: 8f2f3123d1cabff2ad8e3db6a95d4b235f7cad2490955ba460222a7cf36d71df
                                                                                                                                                                                                                                                        • Instruction ID: 3cbb6448559b54469f451e72e1047cc61f4af3bfb7d9b72b56cc114a0c1b924e
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 8f2f3123d1cabff2ad8e3db6a95d4b235f7cad2490955ba460222a7cf36d71df
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 79517D22A0864685EA60FB11AC503BAA392EF85F94FD44236FD4D47799EF3CE546C720
                                                                                                                                                                                                                                                        Function 00007FF70568ED10 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMONLIBRARYCODE
                                                                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        • FreeLibrary.KERNEL32(?,?,?,00007FF70568F0AA,?,?,-00000018,00007FF70568AD53,?,?,?,00007FF70568AC4A,?,?,?,00007FF705685F3E), ref: 00007FF70568EE8C
                                                                                                                                                                                                                                                        • GetProcAddress.KERNEL32(?,?,?,00007FF70568F0AA,?,?,-00000018,00007FF70568AD53,?,?,?,00007FF70568AC4A,?,?,?,00007FF705685F3E), ref: 00007FF70568EE98
                                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2506127906.00007FF705671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF705670000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506100994.00007FF705670000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506163767.00007FF70569B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506256106.00007FF7056B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff705670000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: AddressFreeLibraryProc
                                                                                                                                                                                                                                                        • String ID: api-ms-$ext-ms-
                                                                                                                                                                                                                                                        • API String ID: 3013587201-537541572
                                                                                                                                                                                                                                                        • Opcode ID: 113d78e4ddfca44ef7199ea688f338981f8b4522c7c5ddaba00381c3941a83e2
                                                                                                                                                                                                                                                        • Instruction ID: 7b832a640f9183d66b3a2fc4230320ee7c41e04bd0cf21def4d24c6f898df0f7
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 113d78e4ddfca44ef7199ea688f338981f8b4522c7c5ddaba00381c3941a83e2
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 29410321B19A1281FA15EB16AC14675A39BBF48FA0FC84639FD1D47794EF3DE805C320
                                                                                                                                                                                                                                                        Function 00007FF7056736B0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 61COMMON
                                                                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        • GetModuleFileNameW.KERNEL32(?,00007FF705673804), ref: 00007FF7056736E1
                                                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,00007FF705673804), ref: 00007FF7056736EB
                                                                                                                                                                                                                                                          • Part of subcall function 00007FF705672C50: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF705673706,?,00007FF705673804), ref: 00007FF705672C9E
                                                                                                                                                                                                                                                          • Part of subcall function 00007FF705672C50: FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF705673706,?,00007FF705673804), ref: 00007FF705672D63
                                                                                                                                                                                                                                                          • Part of subcall function 00007FF705672C50: MessageBoxW.USER32 ref: 00007FF705672D99
                                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2506127906.00007FF705671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF705670000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506100994.00007FF705670000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506163767.00007FF70569B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506256106.00007FF7056B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff705670000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: Message$CurrentErrorFileFormatLastModuleNameProcess
                                                                                                                                                                                                                                                        • String ID: Failed to convert executable path to UTF-8.$Failed to obtain executable path.$Failed to resolve full path to executable %ls.$GetModuleFileNameW$\\?\
                                                                                                                                                                                                                                                        • API String ID: 3187769757-2863816727
                                                                                                                                                                                                                                                        • Opcode ID: 7a7bb6314ef99d1ea6b5a99dff4d55fbb7227be169d5ba9e119ffda366a0a745
                                                                                                                                                                                                                                                        • Instruction ID: c8426b749d7f681d1dab02d9e3111407b507a01737bee552a87f833fefaa6130
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 7a7bb6314ef99d1ea6b5a99dff4d55fbb7227be169d5ba9e119ffda366a0a745
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 2421A3A1B1C64691FA60F724EC143B6A396BF98F54FC00236F55D826D5EF2CE504C724
                                                                                                                                                                                                                                                        Function 00007FF70568BA5C Relevance: 10.8, APIs: 7, Instructions: 290COMMONLIBRARYCODE
                                                                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                                                                        control_flow_graph 901 7ff70568ba5c-7ff70568ba82 902 7ff70568ba84-7ff70568ba98 call 7ff705684ee8 call 7ff705684f08 901->902 903 7ff70568ba9d-7ff70568baa1 901->903 917 7ff70568be8e 902->917 904 7ff70568be77-7ff70568be83 call 7ff705684ee8 call 7ff705684f08 903->904 905 7ff70568baa7-7ff70568baae 903->905 924 7ff70568be89 call 7ff70568a8e0 904->924 905->904 907 7ff70568bab4-7ff70568bae2 905->907 907->904 911 7ff70568bae8-7ff70568baef 907->911 914 7ff70568baf1-7ff70568bb03 call 7ff705684ee8 call 7ff705684f08 911->914 915 7ff70568bb08-7ff70568bb0b 911->915 914->924 920 7ff70568bb11-7ff70568bb17 915->920 921 7ff70568be73-7ff70568be75 915->921 922 7ff70568be91-7ff70568bea8 917->922 920->921 925 7ff70568bb1d-7ff70568bb20 920->925 921->922 924->917 925->914 928 7ff70568bb22-7ff70568bb47 925->928 930 7ff70568bb49-7ff70568bb4b 928->930 931 7ff70568bb7a-7ff70568bb81 928->931 932 7ff70568bb72-7ff70568bb78 930->932 933 7ff70568bb4d-7ff70568bb54 930->933 934 7ff70568bb83-7ff70568bbab call 7ff70568d5fc call 7ff70568a948 * 2 931->934 935 7ff70568bb56-7ff70568bb6d call 7ff705684ee8 call 7ff705684f08 call 7ff70568a8e0 931->935 937 7ff70568bbf8-7ff70568bc0f 932->937 933->932 933->935 961 7ff70568bbc8-7ff70568bbf3 call 7ff70568c284 934->961 962 7ff70568bbad-7ff70568bbc3 call 7ff705684f08 call 7ff705684ee8 934->962 965 7ff70568bd00 935->965 940 7ff70568bc11-7ff70568bc19 937->940 941 7ff70568bc8a-7ff70568bc94 call 7ff70569391c 937->941 940->941 945 7ff70568bc1b-7ff70568bc1d 940->945 952 7ff70568bc9a-7ff70568bcaf 941->952 953 7ff70568bd1e 941->953 945->941 949 7ff70568bc1f-7ff70568bc35 945->949 949->941 954 7ff70568bc37-7ff70568bc43 949->954 952->953 959 7ff70568bcb1-7ff70568bcc3 GetConsoleMode 952->959 957 7ff70568bd23-7ff70568bd43 ReadFile 953->957 954->941 960 7ff70568bc45-7ff70568bc47 954->960 963 7ff70568bd49-7ff70568bd51 957->963 964 7ff70568be3d-7ff70568be46 GetLastError 957->964 959->953 966 7ff70568bcc5-7ff70568bccd 959->966 960->941 967 7ff70568bc49-7ff70568bc61 960->967 961->937 962->965 963->964 970 7ff70568bd57 963->970 973 7ff70568be63-7ff70568be66 964->973 974 7ff70568be48-7ff70568be5e call 7ff705684f08 call 7ff705684ee8 964->974 975 7ff70568bd03-7ff70568bd0d call 7ff70568a948 965->975 966->957 972 7ff70568bccf-7ff70568bcf1 ReadConsoleW 966->972 967->941 968 7ff70568bc63-7ff70568bc6f 967->968 968->941 976 7ff70568bc71-7ff70568bc73 968->976 980 7ff70568bd5e-7ff70568bd73 970->980 982 7ff70568bd12-7ff70568bd1c 972->982 983 7ff70568bcf3 GetLastError 972->983 977 7ff70568bcf9-7ff70568bcfb call 7ff705684e7c 973->977 978 7ff70568be6c-7ff70568be6e 973->978 974->965 975->922 976->941 987 7ff70568bc75-7ff70568bc85 976->987 977->965 978->975 980->975 989 7ff70568bd75-7ff70568bd80 980->989 982->980 983->977 987->941 993 7ff70568bd82-7ff70568bd9b call 7ff70568b674 989->993 994 7ff70568bda7-7ff70568bdaf 989->994 1001 7ff70568bda0-7ff70568bda2 993->1001 998 7ff70568bdb1-7ff70568bdc3 994->998 999 7ff70568be2b-7ff70568be38 call 7ff70568b4b4 994->999 1002 7ff70568bdc5 998->1002 1003 7ff70568be1e-7ff70568be26 998->1003 999->1001 1001->975 1005 7ff70568bdca-7ff70568bdd1 1002->1005 1003->975 1006 7ff70568bdd3-7ff70568bdd7 1005->1006 1007 7ff70568be0d-7ff70568be18 1005->1007 1008 7ff70568bdf3 1006->1008 1009 7ff70568bdd9-7ff70568bde0 1006->1009 1007->1003 1011 7ff70568bdf9-7ff70568be09 1008->1011 1009->1008 1010 7ff70568bde2-7ff70568bde6 1009->1010 1010->1008 1012 7ff70568bde8-7ff70568bdf1 1010->1012 1011->1005 1013 7ff70568be0b 1011->1013 1012->1011 1013->1003
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2506127906.00007FF705671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF705670000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506100994.00007FF705670000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506163767.00007FF70569B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506256106.00007FF7056B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff705670000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                                        • API String ID: 3215553584-0
                                                                                                                                                                                                                                                        • Opcode ID: 1c0df5e74df0118619baac061aee596465bcef498cfc928fc9eaa168a483e3b3
                                                                                                                                                                                                                                                        • Instruction ID: fe77dfab0cb8066e4c30de1c74c9a849800485886d58c1fc95875f797def1271
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 1c0df5e74df0118619baac061aee596465bcef498cfc928fc9eaa168a483e3b3
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 10C1A32290C687D5EA60AB1598442BDBBA6FF81F90FD94231FA4D077A1CF7CE445C720
                                                                                                                                                                                                                                                        Function 00007FF705678570 Relevance: 10.6, APIs: 7, Instructions: 63COMMON
                                                                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2506127906.00007FF705671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF705670000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506100994.00007FF705670000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506163767.00007FF70569B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506256106.00007FF7056B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff705670000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: Token$InformationProcess$CloseConvertCurrentErrorHandleLastOpenString
                                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                                        • API String ID: 995526605-0
                                                                                                                                                                                                                                                        • Opcode ID: 1c88e2159774aae00215e56fe2a2a719af09135261df6dbcfc7a62e4558c2eb4
                                                                                                                                                                                                                                                        • Instruction ID: db06b6db1b19e6dd02d86e4bd00a5e6b51359115c2fc39b40107d3cf82c4ca9f
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 1c88e2159774aae00215e56fe2a2a719af09135261df6dbcfc7a62e4558c2eb4
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: D1212131A0C64682EA50AB65B94423AE3A6EF85FA4F900235FA6D43BE4DF7CD8458710
                                                                                                                                                                                                                                                        Function 00007FF7056790E0 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 64COMMON
                                                                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                          • Part of subcall function 00007FF705678570: GetCurrentProcess.KERNEL32 ref: 00007FF705678590
                                                                                                                                                                                                                                                          • Part of subcall function 00007FF705678570: OpenProcessToken.ADVAPI32 ref: 00007FF7056785A3
                                                                                                                                                                                                                                                          • Part of subcall function 00007FF705678570: GetTokenInformation.KERNELBASE ref: 00007FF7056785C8
                                                                                                                                                                                                                                                          • Part of subcall function 00007FF705678570: GetLastError.KERNEL32 ref: 00007FF7056785D2
                                                                                                                                                                                                                                                          • Part of subcall function 00007FF705678570: GetTokenInformation.KERNELBASE ref: 00007FF705678612
                                                                                                                                                                                                                                                          • Part of subcall function 00007FF705678570: ConvertSidToStringSidW.ADVAPI32 ref: 00007FF70567862E
                                                                                                                                                                                                                                                          • Part of subcall function 00007FF705678570: CloseHandle.KERNEL32 ref: 00007FF705678646
                                                                                                                                                                                                                                                        • LocalFree.KERNEL32(?,00007FF705673C55), ref: 00007FF70567916C
                                                                                                                                                                                                                                                        • LocalFree.KERNEL32(?,00007FF705673C55), ref: 00007FF705679175
                                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2506127906.00007FF705671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF705670000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506100994.00007FF705670000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506163767.00007FF70569B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506256106.00007FF7056B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff705670000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: Token$FreeInformationLocalProcess$CloseConvertCurrentErrorHandleLastOpenString
                                                                                                                                                                                                                                                        • String ID: D:(A;;FA;;;%s)$D:(A;;FA;;;%s)(A;;FA;;;%s)$S-1-3-4$Security descriptor string length exceeds PYI_PATH_MAX!
                                                                                                                                                                                                                                                        • API String ID: 6828938-1529539262
                                                                                                                                                                                                                                                        • Opcode ID: 0222097b9c90264a1a2c87a2a2fde68e1a94831f5278aced0db9eca26447961c
                                                                                                                                                                                                                                                        • Instruction ID: 9e4796e52cf1a3eeaf65a93d238ac5122364f884741908afd26f7839548530be
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 0222097b9c90264a1a2c87a2a2fde68e1a94831f5278aced0db9eca26447961c
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 77212B21A0868682F750FB10ED152EAA3A6EF88F80FD44036FA4D43796DF3CD955C7A0
                                                                                                                                                                                                                                                        Function 00007FF705677E20 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 81COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        • CreateDirectoryW.KERNELBASE(00000000,?,00007FF70567352C,?,00000000,00007FF705673F23), ref: 00007FF705677F32
                                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2506127906.00007FF705671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF705670000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506100994.00007FF705670000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506163767.00007FF70569B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506256106.00007FF7056B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff705670000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: CreateDirectory
                                                                                                                                                                                                                                                        • String ID: %.*s$%s%c$\
                                                                                                                                                                                                                                                        • API String ID: 4241100979-1685191245
                                                                                                                                                                                                                                                        • Opcode ID: 9023beffec3a57a4629e8abb22503f1b718fcdb28fa34784c50d465fb9ddbb72
                                                                                                                                                                                                                                                        • Instruction ID: 3e2d0ec6510c91ae75d0ebaa9c93a31880d110b527e82a6b847397f1e384df9f
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 9023beffec3a57a4629e8abb22503f1b718fcdb28fa34784c50d465fb9ddbb72
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: B631B621619AC945FB21EB21EC507AAA356EF84FE4F844231FA6D477C9EF3CD6418710
                                                                                                                                                                                                                                                        Function 00007FF70568CF60 Relevance: 6.2, APIs: 4, Instructions: 218COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        • GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF70568CF4B), ref: 00007FF70568D07C
                                                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF70568CF4B), ref: 00007FF70568D107
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2506127906.00007FF705671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF705670000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506100994.00007FF705670000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506163767.00007FF70569B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506256106.00007FF7056B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff705670000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: ConsoleErrorLastMode
                                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                                        • API String ID: 953036326-0
                                                                                                                                                                                                                                                        • Opcode ID: a47a8d54e36ced6583969bea4ac316e5fdc1f02f5f342ddc714eca2f45cad1a1
                                                                                                                                                                                                                                                        • Instruction ID: 74019fa7cf16155adeb4abbaf82eca6946a287a73da63f9ef4eec5ef9ef9e2bd
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: a47a8d54e36ced6583969bea4ac316e5fdc1f02f5f342ddc714eca2f45cad1a1
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: C991B262A18651C5F760AF65984027DABB2BF44F88F944235EE4E66A94DF38E442C730
                                                                                                                                                                                                                                                        Function 00007FF70568F98C Relevance: 6.2, APIs: 4, Instructions: 162COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2506127906.00007FF705671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF705670000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506100994.00007FF705670000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506163767.00007FF70569B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506256106.00007FF7056B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff705670000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: _get_daylight$_isindst
                                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                                        • API String ID: 4170891091-0
                                                                                                                                                                                                                                                        • Opcode ID: 873197461a12b50781dd6dd2a54ab0b7f590f407db75148e336b6c99fa373a01
                                                                                                                                                                                                                                                        • Instruction ID: 4436ac7eb9a37c5fb7b0c0fc45f0074aed5e9dc5c31152af81b81b12d3d17b8f
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 873197461a12b50781dd6dd2a54ab0b7f590f407db75148e336b6c99fa373a01
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 53510472F04212CAEB14EF64DD616BCE7A6AF54F68F940335FD1E52AE5DF38A4028610
                                                                                                                                                                                                                                                        Function 00007FF70568577C Relevance: 6.1, APIs: 4, Instructions: 119pipeCOMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2506127906.00007FF705671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF705670000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506100994.00007FF705670000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506163767.00007FF70569B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506256106.00007FF7056B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff705670000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: File$ErrorHandleInformationLastNamedPeekPipeType
                                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                                        • API String ID: 2780335769-0
                                                                                                                                                                                                                                                        • Opcode ID: 6aefb500db5e0848cb3e1a230f039049599ff649377a7022c72adab745f1037c
                                                                                                                                                                                                                                                        • Instruction ID: 8b6d9f72f7280e1b60c4b85aa1df1292c509ba615bb652e4d74b1e89c91d3518
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 6aefb500db5e0848cb3e1a230f039049599ff649377a7022c72adab745f1037c
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 53519C72E086419AFB50EF70D8503BDA7A2AF58F98F948635EE0E57688DF38D4408720
                                                                                                                                                                                                                                                        Function 00007FF705685628 Relevance: 6.1, APIs: 4, Instructions: 90fileCOMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2506127906.00007FF705671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF705670000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506100994.00007FF705670000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506163767.00007FF70569B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506256106.00007FF7056B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff705670000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: CloseCreateFileHandle_invalid_parameter_noinfo
                                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                                        • API String ID: 1279662727-0
                                                                                                                                                                                                                                                        • Opcode ID: 8f3d5377b4ca72f71b0fe910297a4b2920b1cd85568e136600ee028e7f718979
                                                                                                                                                                                                                                                        • Instruction ID: 111543add3e82ea960fce44f970a547869dbc89ea2d696a79202277591a20a8a
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 8f3d5377b4ca72f71b0fe910297a4b2920b1cd85568e136600ee028e7f718979
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 79418372D18782D3E750AB609950379A261FFA4FA4F509335F65D03AE1DF7CA5E08720
                                                                                                                                                                                                                                                        Function 00007FF70567CC3C Relevance: 4.6, APIs: 3, Instructions: 94COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2506127906.00007FF705671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF705670000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506100994.00007FF705670000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506163767.00007FF70569B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506256106.00007FF7056B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff705670000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_release_startup_lock
                                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                                        • API String ID: 3251591375-0
                                                                                                                                                                                                                                                        • Opcode ID: b3dd18574e8b698ea28c35ed35ed65a6730a16d6ac14c38d0a8ba428da0d66bc
                                                                                                                                                                                                                                                        • Instruction ID: 0b913cd639c9934f62f31ddd6dcc557f2916d1dc3954cf5a3f86660449a26dba
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: b3dd18574e8b698ea28c35ed35ed65a6730a16d6ac14c38d0a8ba428da0d66bc
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 1C311721E4C54A81FA24FB65AC222B99793AF81F84FC45534FA0E472E7DF2CA904C331
                                                                                                                                                                                                                                                        Function 00007FF705689A30 Relevance: 4.5, APIs: 3, Instructions: 14COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2506127906.00007FF705671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF705670000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506100994.00007FF705670000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506163767.00007FF70569B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506256106.00007FF7056B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff705670000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: Process$CurrentExitTerminate
                                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                                        • API String ID: 1703294689-0
                                                                                                                                                                                                                                                        • Opcode ID: 148d460979eed4a43ebbf671c65dc2dc638c0d89c9c01e8e00358d5495882c84
                                                                                                                                                                                                                                                        • Instruction ID: 7ba7d3592b46cdf1d8e291dbd44162a17a8bb961936dadaf7536fef9d24c9e7d
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 148d460979eed4a43ebbf671c65dc2dc638c0d89c9c01e8e00358d5495882c84
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 44D09210B0C74682EB187B706C99078925B6F88F01F9425B8E80F563A3EF2CA8498320
                                                                                                                                                                                                                                                        Function 00007FF70568013C Relevance: 3.2, APIs: 2, Instructions: 177COMMONLIBRARYCODE
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2506127906.00007FF705671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF705670000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506100994.00007FF705670000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506163767.00007FF70569B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506256106.00007FF7056B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff705670000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                                        • API String ID: 3215553584-0
                                                                                                                                                                                                                                                        • Opcode ID: 2fd4b9cf4e2c203a215f80a0453bc9b94d2a0e119ef729a2f51343e3c0f92604
                                                                                                                                                                                                                                                        • Instruction ID: d0e6a72623e5322e96b8518bc04aa2ceb4eaf36c307622867bcb345bd625b561
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 2fd4b9cf4e2c203a215f80a0453bc9b94d2a0e119ef729a2f51343e3c0f92604
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 4351D761B09242C7F764BA659C0867AE692AF44FB4F984B34FD6D037D5CF3CE4058620
                                                                                                                                                                                                                                                        Function 00007FF70568C134 Relevance: 3.0, APIs: 2, Instructions: 46COMMONLIBRARYCODE
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2506127906.00007FF705671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF705670000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506100994.00007FF705670000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506163767.00007FF70569B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506256106.00007FF7056B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff705670000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: ErrorFileLastPointer
                                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                                        • API String ID: 2976181284-0
                                                                                                                                                                                                                                                        • Opcode ID: 7d52f85de62641260209e8dbb28c5e1251e01e8bf24b4306ce9dcd9badf2c9c6
                                                                                                                                                                                                                                                        • Instruction ID: 84ce6215eade2d6aecf01a43ab65e5f4226931365ea4dcf659308e2b3d8f6f6f
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 7d52f85de62641260209e8dbb28c5e1251e01e8bf24b4306ce9dcd9badf2c9c6
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 7311B261618A8181EA20AB25BC54179A362AF45FF4F944331FEBD0B7E9CF3CE4518710
                                                                                                                                                                                                                                                        Function 00007FF705685924 Relevance: 3.0, APIs: 2, Instructions: 40timeCOMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        • FileTimeToSystemTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF705685839), ref: 00007FF705685957
                                                                                                                                                                                                                                                        • SystemTimeToTzSpecificLocalTime.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF705685839), ref: 00007FF70568596D
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2506127906.00007FF705671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF705670000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506100994.00007FF705670000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506163767.00007FF70569B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506256106.00007FF7056B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff705670000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: Time$System$FileLocalSpecific
                                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                                        • API String ID: 1707611234-0
                                                                                                                                                                                                                                                        • Opcode ID: 497c6f3b45805196ef8f930e068bad9451f3f50de380bc241881b145e929bf5b
                                                                                                                                                                                                                                                        • Instruction ID: 79add3661750bac2c8def545f53004ba6e4d0be81b542c504e682886bd8719c4
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 497c6f3b45805196ef8f930e068bad9451f3f50de380bc241881b145e929bf5b
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 3F11823160C652C2EA54AB14A81103AF766EF94F71F900336F6AA819D4EF2CD454DF20
                                                                                                                                                                                                                                                        Function 00007FF70568A948 Relevance: 3.0, APIs: 2, Instructions: 19memoryCOMMONLIBRARYCODE
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        • RtlFreeHeap.NTDLL(?,?,?,00007FF705692D22,?,?,?,00007FF705692D5F,?,?,00000000,00007FF705693225,?,?,?,00007FF705693157), ref: 00007FF70568A95E
                                                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,?,?,00007FF705692D22,?,?,?,00007FF705692D5F,?,?,00000000,00007FF705693225,?,?,?,00007FF705693157), ref: 00007FF70568A968
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2506127906.00007FF705671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF705670000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506100994.00007FF705670000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506163767.00007FF70569B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506256106.00007FF7056B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff705670000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: ErrorFreeHeapLast
                                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                                        • API String ID: 485612231-0
                                                                                                                                                                                                                                                        • Opcode ID: 46e6024f15a2f57ad5ff64688e0fe3cec5898f8577aba2f63b046adc8766ef53
                                                                                                                                                                                                                                                        • Instruction ID: de62d41b06a906ee8d56e9a0d93d66ef436985158cfcc653cf7e600216024d8f
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 46e6024f15a2f57ad5ff64688e0fe3cec5898f8577aba2f63b046adc8766ef53
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 2AE04620F1D202C2FE19BBF2AC4513892926F88F01FC40235E81D422A1EF2C68818230
                                                                                                                                                                                                                                                        Function 00007FF70568AB58 Relevance: 2.6, APIs: 2, Instructions: 59COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        • CloseHandle.KERNELBASE(?,?,?,00007FF70568A9D5,?,?,00000000,00007FF70568AA8A), ref: 00007FF70568ABC6
                                                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,?,?,00007FF70568A9D5,?,?,00000000,00007FF70568AA8A), ref: 00007FF70568ABD0
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2506127906.00007FF705671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF705670000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506100994.00007FF705670000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506163767.00007FF70569B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506256106.00007FF7056B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff705670000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: CloseErrorHandleLast
                                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                                        • API String ID: 918212764-0
                                                                                                                                                                                                                                                        • Opcode ID: ae1e15d82824e1a5fac1c7302ca2ff5641fe0b0e43db7728cd9339717749910c
                                                                                                                                                                                                                                                        • Instruction ID: d4b4f3dd1ffae5dd3ef8b09f8b66705c79c10cb1d6d3b37b118e6948f93ac3db
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: ae1e15d82824e1a5fac1c7302ca2ff5641fe0b0e43db7728cd9339717749910c
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 7C218711B1864281FA6477919C9437D96939F84FA4F884736FE1E477D1DF6CE4818320
                                                                                                                                                                                                                                                        Function 00007FF70568BEAC Relevance: 1.6, APIs: 1, Instructions: 112COMMONLIBRARYCODE
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2506127906.00007FF705671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF705670000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506100994.00007FF705670000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506163767.00007FF70569B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506256106.00007FF7056B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff705670000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                                        • API String ID: 3215553584-0
                                                                                                                                                                                                                                                        • Opcode ID: 5a303e376ae32d58fd1e52f1ac99a64fdc1cf63549abbe0bdd4da132c2ec767e
                                                                                                                                                                                                                                                        • Instruction ID: 6f44735fda22cd38c1b483958b47e051b5c6381875e87a846e816238b85f11db
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 5a303e376ae32d58fd1e52f1ac99a64fdc1cf63549abbe0bdd4da132c2ec767e
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 0741B332918645C7EA34AB59A940279B3A2EF55F90F940331FB8E437E1CF6CE402CB61
                                                                                                                                                                                                                                                        Function 00007FF705677F90 Relevance: 1.6, APIs: 1, Instructions: 85COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2506127906.00007FF705671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF705670000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506100994.00007FF705670000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506163767.00007FF70569B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506256106.00007FF7056B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff705670000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: _fread_nolock
                                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                                        • API String ID: 840049012-0
                                                                                                                                                                                                                                                        • Opcode ID: 7026eb3b68f3585a2f5768ea15c5ca7bda34a28a3ae4cdbb6486ed2f903c9d01
                                                                                                                                                                                                                                                        • Instruction ID: 1c68b71173381e93e9e6207140122b386a3d6e96ca6ca00304f7deae43c20241
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 7026eb3b68f3585a2f5768ea15c5ca7bda34a28a3ae4cdbb6486ed2f903c9d01
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: CE216D21B1865686EA50FA226D087BADB52BF85FD4FC84430FE0D07786DF7DE845C610
                                                                                                                                                                                                                                                        Function 00007FF70568B93C Relevance: 1.6, APIs: 1, Instructions: 79COMMONLIBRARYCODE
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2506127906.00007FF705671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF705670000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506100994.00007FF705670000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506163767.00007FF70569B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506256106.00007FF7056B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff705670000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                                        • API String ID: 3215553584-0
                                                                                                                                                                                                                                                        • Opcode ID: 0fe3e981c7cf3185d146a9a4244026f2f164e791e6f92d2a50fd94940550a020
                                                                                                                                                                                                                                                        • Instruction ID: 3fe1a113ee7cdec62ff4ea2f89fda38f206bfc754dd24d3512108d568cbb7050
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 0fe3e981c7cf3185d146a9a4244026f2f164e791e6f92d2a50fd94940550a020
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: C1315C32A18602C5FA51BB558C4137CAA92AF81FA5FC10335F92D173E2CF7CA4418731
                                                                                                                                                                                                                                                        Function 00007FF705689961 Relevance: 1.6, APIs: 1, Instructions: 61COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2506127906.00007FF705671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF705670000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506100994.00007FF705670000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506163767.00007FF70569B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506256106.00007FF7056B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff705670000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: HandleModule$AddressFreeLibraryProc
                                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                                        • API String ID: 3947729631-0
                                                                                                                                                                                                                                                        • Opcode ID: 42808d7c08696a35870eb95595f0ae95ff90971c005bfc8769c42bb91e99b0de
                                                                                                                                                                                                                                                        • Instruction ID: be3efa34e133d569abef3e45cb98a1bbbdfeed4c2573e270e8ade93c9aa0c19d
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 42808d7c08696a35870eb95595f0ae95ff90971c005bfc8769c42bb91e99b0de
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: AE216B72A14746CAEF64AF64C8802BC73A1EB44F18F884636E76D06AD5DF38D584C760
                                                                                                                                                                                                                                                        Function 00007FF705685F94 Relevance: 1.6, APIs: 1, Instructions: 55COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2506127906.00007FF705671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF705670000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506100994.00007FF705670000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506163767.00007FF70569B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506256106.00007FF7056B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff705670000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                                        • API String ID: 3215553584-0
                                                                                                                                                                                                                                                        • Opcode ID: d0ecc1d4814c8292f6d285d86e9f4332b8d7141ecd04c52723bb65a1ba9d936a
                                                                                                                                                                                                                                                        • Instruction ID: 1c1dab675ab7eb76e8efdfcaad38423de79424d8aa1ac43175ed3b72f9383a69
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: d0ecc1d4814c8292f6d285d86e9f4332b8d7141ecd04c52723bb65a1ba9d936a
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 8F117531A1C642D1EA60BF519C0017DE6A6BF95F84FC44636FA4D57B96CF7DD4008B20
                                                                                                                                                                                                                                                        Function 00007FF705696354 Relevance: 1.6, APIs: 1, Instructions: 54COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2506127906.00007FF705671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF705670000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506100994.00007FF705670000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506163767.00007FF70569B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506256106.00007FF7056B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff705670000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                                        • API String ID: 3215553584-0
                                                                                                                                                                                                                                                        • Opcode ID: 3765a10cee1e255344ee37f065f4be71d58868c9c9e645b3056c9746d3493235
                                                                                                                                                                                                                                                        • Instruction ID: 0b37c9c21d28a3cff80f09ba5c12cc2749366ff976e777278b722e644afa3027
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 3765a10cee1e255344ee37f065f4be71d58868c9c9e645b3056c9746d3493235
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 4021C272A08B4286EB60AF18D840379B6A2FF84F94F944334FA5E876D9DF3CD4118B10
                                                                                                                                                                                                                                                        Function 00007FF7056803BC Relevance: 1.5, APIs: 1, Instructions: 48COMMONLIBRARYCODE
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2506127906.00007FF705671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF705670000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506100994.00007FF705670000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506163767.00007FF70569B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506256106.00007FF7056B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff705670000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                                        • API String ID: 3215553584-0
                                                                                                                                                                                                                                                        • Opcode ID: 8e9754deeba93abb4745aa2efb451e77357aefa8fb0fbddb16feb6c8c90fdd62
                                                                                                                                                                                                                                                        • Instruction ID: db62b0b9e18f64072508269322a2919cbe793ee17682fea0be37145d4d74cc0c
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 8e9754deeba93abb4745aa2efb451e77357aefa8fb0fbddb16feb6c8c90fdd62
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 6E015B61A48746C1EA04AB529D051B9E6A6AF95FF0F894B31FE6C17BD6CF3CE4118320
                                                                                                                                                                                                                                                        Function 00007FF705687EFC Relevance: 1.5, APIs: 1, Instructions: 43COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2506127906.00007FF705671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF705670000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506100994.00007FF705670000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506163767.00007FF70569B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506256106.00007FF7056B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff705670000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                                        • API String ID: 3215553584-0
                                                                                                                                                                                                                                                        • Opcode ID: eb4e03bbc0b04cbc85d5aa4284f536322b5632f0a5d263bd1b62b358e696f9c3
                                                                                                                                                                                                                                                        • Instruction ID: 0eb9b6024ae6737200fa51fe951bb19c7115ae8859ca8374196db60c6ee94381
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: eb4e03bbc0b04cbc85d5aa4284f536322b5632f0a5d263bd1b62b358e696f9c3
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: E7011B20E1D683C0FA607A625D4117996A2EF44FE4FE44735FA2C427C6DF2DA4428230
                                                                                                                                                                                                                                                        Function 00007FF705688238 Relevance: 1.5, APIs: 1, Instructions: 19COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2506127906.00007FF705671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF705670000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506100994.00007FF705670000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506163767.00007FF70569B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506256106.00007FF7056B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff705670000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                                        • API String ID: 3215553584-0
                                                                                                                                                                                                                                                        • Opcode ID: 3541b91b086c77dfe17527b78ee7977ece0d5fdea915d925a3ffaee66e22a6c2
                                                                                                                                                                                                                                                        • Instruction ID: 23f3d64081162054d3d4da1fa354579d3add084b4d52633ab3e1cbc1c8800c81
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 3541b91b086c77dfe17527b78ee7977ece0d5fdea915d925a3ffaee66e22a6c2
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: B2E0B650E18607C6FA657AA44D9217995629F95F40FD04A35FA08062C3EF2C68559631
                                                                                                                                                                                                                                                        Function 00007FF70568EB98 Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        • HeapAlloc.KERNEL32(?,?,00000000,00007FF70568B32A,?,?,?,00007FF705684F11,?,?,?,?,00007FF70568A48A), ref: 00007FF70568EBED
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2506127906.00007FF705671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF705670000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506100994.00007FF705670000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506163767.00007FF70569B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506256106.00007FF7056B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff705670000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: AllocHeap
                                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                                        • API String ID: 4292702814-0
                                                                                                                                                                                                                                                        • Opcode ID: 0190c006dd090f1dc8136ef035d08a675b61e1fdbed98732a32380f018d60316
                                                                                                                                                                                                                                                        • Instruction ID: 600f32eda19e88c445c8341e6c43c87a1215827139e8131482fc85bc0b0dc115
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 0190c006dd090f1dc8136ef035d08a675b61e1fdbed98732a32380f018d60316
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 55F04958B09202C1FE5976659E512B4828A5F88F80FCC4630ED0F863D1EF6DE8858230
                                                                                                                                                                                                                                                        Function 00007FF70568D5FC Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        • HeapAlloc.KERNEL32(?,?,?,00007FF705680C90,?,?,?,00007FF7056822FA,?,?,?,?,?,00007FF705683AE9), ref: 00007FF70568D63A
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2506127906.00007FF705671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF705670000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506100994.00007FF705670000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506163767.00007FF70569B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506256106.00007FF7056B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff705670000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: AllocHeap
                                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                                        • API String ID: 4292702814-0
                                                                                                                                                                                                                                                        • Opcode ID: 510c613edcbd96140e332c46b5608733b20d975e117422ad796dc4540c81bb80
                                                                                                                                                                                                                                                        • Instruction ID: 1c84f391b6cdc019b55d84cd2d00b6c1f2bc0701c6425d780f79a8ba9510995a
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 510c613edcbd96140e332c46b5608733b20d975e117422ad796dc4540c81bb80
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: D1F0D450B0924AC5FE657A615C5177992A65F88FB4F880730F92E862C2DF2CA4C08630

                                                                                                                                                                                                                                                        Non-executed Functions

                                                                                                                                                                                                                                                        Function 00007FF7056776C0 Relevance: 177.1, APIs: 66, Strings: 35, Instructions: 314libraryloaderCOMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2506127906.00007FF705671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF705670000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506100994.00007FF705670000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506163767.00007FF70569B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506256106.00007FF7056B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff705670000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: AddressErrorLastProc
                                                                                                                                                                                                                                                        • String ID: Failed to get address for %hs$GetProcAddress$Tcl_Alloc$Tcl_ConditionFinalize$Tcl_ConditionNotify$Tcl_ConditionWait$Tcl_CreateInterp$Tcl_CreateObjCommand$Tcl_CreateThread$Tcl_DeleteInterp$Tcl_DoOneEvent$Tcl_EvalEx$Tcl_EvalFile$Tcl_EvalObjv$Tcl_Finalize$Tcl_FinalizeThread$Tcl_FindExecutable$Tcl_Free$Tcl_GetCurrentThread$Tcl_GetObjResult$Tcl_GetString$Tcl_GetVar2$Tcl_Init$Tcl_JoinThread$Tcl_MutexFinalize$Tcl_MutexLock$Tcl_MutexUnlock$Tcl_NewByteArrayObj$Tcl_NewStringObj$Tcl_SetVar2$Tcl_SetVar2Ex$Tcl_ThreadAlert$Tcl_ThreadQueueEvent$Tk_GetNumMainWindows$Tk_Init
                                                                                                                                                                                                                                                        • API String ID: 199729137-3427451314
                                                                                                                                                                                                                                                        • Opcode ID: 939c8a0ebf27c7f5789cd4a10996167767bc86255d761b2ba34a42bc6fc861e3
                                                                                                                                                                                                                                                        • Instruction ID: b26a15628ebb03ac8685c35342437b2da28e9827996ab7268cca3396d06d95bf
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 939c8a0ebf27c7f5789cd4a10996167767bc86255d761b2ba34a42bc6fc861e3
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 2E02A164A0DB0B91FA15FB55BD105B4A3ABAF45F45FD401B2F82E022A4EF3CB599D230
                                                                                                                                                                                                                                                        Function 00007FF7056940AC Relevance: 24.0, APIs: 9, Strings: 4, Instructions: 1226COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2506127906.00007FF705671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF705670000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506100994.00007FF705670000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506163767.00007FF70569B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506256106.00007FF7056B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff705670000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: _invalid_parameter_noinfo$memcpy_s$fegetenv
                                                                                                                                                                                                                                                        • String ID: 1#IND$1#INF$1#QNAN$1#SNAN
                                                                                                                                                                                                                                                        • API String ID: 808467561-2761157908
                                                                                                                                                                                                                                                        • Opcode ID: 7da0388417e7c773b0aab48e07e342724827a26e5879d16e5decf6c79e081c8c
                                                                                                                                                                                                                                                        • Instruction ID: 98a771b86c4499534ac1d65fd94c370dfb04e314dea0a8e9f7a09c3be48979f5
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 7da0388417e7c773b0aab48e07e342724827a26e5879d16e5decf6c79e081c8c
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 29B2E772A182828BEB359F64D8407FDB7A6FF54F89F801175EA0D57A84DF38A901CB50
                                                                                                                                                                                                                                                        Function 00007FF70567ACAD Relevance: 12.0, Strings: 9, Instructions: 744COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2506127906.00007FF705671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF705670000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506100994.00007FF705670000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506163767.00007FF70569B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506256106.00007FF7056B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff705670000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                                                        • String ID: invalid bit length repeat$invalid code -- missing end-of-block$invalid code lengths set$invalid distance code$invalid distance too far back$invalid distances set$invalid literal/length code$invalid literal/lengths set$too many length or distance symbols
                                                                                                                                                                                                                                                        • API String ID: 0-2665694366
                                                                                                                                                                                                                                                        • Opcode ID: 55880860ec2df9374ed9e05eb7c1f9660e2769407a38999da05ffb99d6c3dc89
                                                                                                                                                                                                                                                        • Instruction ID: 68cf878f3d7adc142db68de4408c32d7c602bad5437009807a1ef16f38095bbe
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 55880860ec2df9374ed9e05eb7c1f9660e2769407a38999da05ffb99d6c3dc89
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 5152F672A146AA8BD7A4DF14D858B7E7BAAFF44B40F414139F64A87780EB3CD844CB50
                                                                                                                                                                                                                                                        Function 00007FF70567D12C Relevance: 10.6, APIs: 7, Instructions: 71COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2506127906.00007FF705671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF705670000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506100994.00007FF705670000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506163767.00007FF70569B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506256106.00007FF7056B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff705670000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
                                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                                        • API String ID: 3140674995-0
                                                                                                                                                                                                                                                        • Opcode ID: 357b26123f7cc0566be18cabbec560c6351d8abd4e8582c9dfa9d4018571b442
                                                                                                                                                                                                                                                        • Instruction ID: 07c34c6664ffc1cd5e338617568b67fa36e725b94da793a115205f2dc25b2009
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 357b26123f7cc0566be18cabbec560c6351d8abd4e8582c9dfa9d4018571b442
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: F9310E72608B8586EB609F60E8403ADB365FB84B48F44443AEA4E47B98DF78D548C710
                                                                                                                                                                                                                                                        Function 00007FF70568A614 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2506127906.00007FF705671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF705670000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506100994.00007FF705670000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506163767.00007FF70569B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506256106.00007FF7056B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff705670000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
                                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                                        • API String ID: 1239891234-0
                                                                                                                                                                                                                                                        • Opcode ID: ae2d74aaff6e8c1310ec24f87c3395aa5518f909cdba62f6f822c67f0a9cc142
                                                                                                                                                                                                                                                        • Instruction ID: 700edb001ef88fc3cc071d0772d0b3aba9dd8d99d7da924467146640a1e1f07e
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: ae2d74aaff6e8c1310ec24f87c3395aa5518f909cdba62f6f822c67f0a9cc142
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: CE316036608B8186EB20DB24EC402BEB3A5FF84F54F900136EA8D43B68DF38D155CB10
                                                                                                                                                                                                                                                        Function 00007FF705691874 Relevance: 7.8, APIs: 5, Instructions: 282COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2506127906.00007FF705671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF705670000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506100994.00007FF705670000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506163767.00007FF70569B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506256106.00007FF7056B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff705670000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: FileFindFirst_invalid_parameter_noinfo
                                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                                        • API String ID: 2227656907-0
                                                                                                                                                                                                                                                        • Opcode ID: ee5daded1920a45b930385d49f4c9fb7106de6f00b6358014c2482279c1420ad
                                                                                                                                                                                                                                                        • Instruction ID: 4852acbc1e6d355ec49eb82db85f94e80fc62502bf6cba41a98ad11ff74a8976
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: ee5daded1920a45b930385d49f4c9fb7106de6f00b6358014c2482279c1420ad
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 5AB1B422B1869781EE61AB219D001B9E396EF86FE4F945172FE5D07B99DF3CE441C310
                                                                                                                                                                                                                                                        Function 00007FF70567D010 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2506127906.00007FF705671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF705670000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506100994.00007FF705670000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506163767.00007FF70569B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506256106.00007FF7056B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff705670000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
                                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                                        • API String ID: 2933794660-0
                                                                                                                                                                                                                                                        • Opcode ID: 884c9866f0db1ea4ea3e8c559fd458021c8c8106c035f87ab540984eb8a2d97e
                                                                                                                                                                                                                                                        • Instruction ID: e983b3d8410c0ea9cbd50893aa38ea55e9427284945d0bbe305160c28321dd1c
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 884c9866f0db1ea4ea3e8c559fd458021c8c8106c035f87ab540984eb8a2d97e
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 6D112E22B18F058AEB00DF60EC542B973A8FB59F58F841E31EA6D467A4DF7CD5648350
                                                                                                                                                                                                                                                        Function 00007FF705693C10 Relevance: 4.8, APIs: 3, Instructions: 340COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2506127906.00007FF705671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF705670000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506100994.00007FF705670000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506163767.00007FF70569B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506256106.00007FF7056B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff705670000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: memcpy_s
                                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                                        • API String ID: 1502251526-0
                                                                                                                                                                                                                                                        • Opcode ID: 723df14fe8405c9280d13974b9e0b256372cd2939c4def8ecbac686ef57d643c
                                                                                                                                                                                                                                                        • Instruction ID: e4fdcd664acc66d8e95639e86ca3260228be1469bdc85ac3aa14be604ea1ab8a
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 723df14fe8405c9280d13974b9e0b256372cd2939c4def8ecbac686ef57d643c
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: CAC1F772B1868687EB24DF15A44466AF7A6FB94F84F848135EB4E43744DF3DE805CB40
                                                                                                                                                                                                                                                        Function 00007FF70567A474 Relevance: 4.1, Strings: 3, Instructions: 398COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2506127906.00007FF705671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF705670000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506100994.00007FF705670000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506163767.00007FF70569B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506256106.00007FF7056B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff705670000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                                                        • String ID: $header crc mismatch$unknown header flags set
                                                                                                                                                                                                                                                        • API String ID: 0-1127688429
                                                                                                                                                                                                                                                        • Opcode ID: fcf6ea83c7a46010d3591867e81b0f53761d3f113121264a3729654d2d1b513f
                                                                                                                                                                                                                                                        • Instruction ID: ae0bc0498e3642c4167a190c150d1a4e413a0efb4ea0da6772a93f16fa7606c3
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: fcf6ea83c7a46010d3591867e81b0f53761d3f113121264a3729654d2d1b513f
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 91F18272A183D98BE7A5EF14C888A3EBBAAEF44F40F554538EA4947390DB38E541C750
                                                                                                                                                                                                                                                        Function 00007FF705699728 Relevance: 3.2, APIs: 2, Instructions: 227COMMONLIBRARYCODE
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2506127906.00007FF705671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF705670000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506100994.00007FF705670000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506163767.00007FF70569B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506256106.00007FF7056B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff705670000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: ExceptionRaise_clrfp
                                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                                        • API String ID: 15204871-0
                                                                                                                                                                                                                                                        • Opcode ID: a4cc0e8a2f7e024105bf8074fef1866164229a93701b52dcf00f6f20498becf3
                                                                                                                                                                                                                                                        • Instruction ID: ec4c74e2bb29a53391ea70a911d1715f7e90b4e462814e124262293b873e28e0
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: a4cc0e8a2f7e024105bf8074fef1866164229a93701b52dcf00f6f20498becf3
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: C3B18E77A00B898BEB55CF29C84636C77A5FB44F48F18886AEA5D837A4CF39D451C710
                                                                                                                                                                                                                                                        Function 00007FF7056839A4 Relevance: 2.8, Strings: 2, Instructions: 350COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2506127906.00007FF705671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF705670000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506100994.00007FF705670000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506163767.00007FF70569B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506256106.00007FF7056B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff705670000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                                                        • String ID: $
                                                                                                                                                                                                                                                        • API String ID: 0-227171996
                                                                                                                                                                                                                                                        • Opcode ID: e57f1980f4491aea9eb328a1e81193c2bccc9a7e68d1918bb9b7207cf9600634
                                                                                                                                                                                                                                                        • Instruction ID: b72ccc82f05e99564695f7dc1f6c79b51919cf64d725985944f65c9c35d50601
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: e57f1980f4491aea9eb328a1e81193c2bccc9a7e68d1918bb9b7207cf9600634
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 25E1A272B08646C6EB68AE29CD5013DB3A2FF45F48FA45B35EA0E07794DF29E851C710
                                                                                                                                                                                                                                                        Function 00007FF70567A2DB Relevance: 2.7, Strings: 2, Instructions: 216COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2506127906.00007FF705671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF705670000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506100994.00007FF705670000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506163767.00007FF70569B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506256106.00007FF7056B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff705670000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                                                        • String ID: incorrect header check$invalid window size
                                                                                                                                                                                                                                                        • API String ID: 0-900081337
                                                                                                                                                                                                                                                        • Opcode ID: 7e7bac63e97a7e962ac1d8bc37368dc0e110af78d4507200a91f80e7c7b94e68
                                                                                                                                                                                                                                                        • Instruction ID: 94e5dc62910917dd45a0ab3cb20c7d1a2180103292e6e9d5c2eeb52223b9a68c
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 7e7bac63e97a7e962ac1d8bc37368dc0e110af78d4507200a91f80e7c7b94e68
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 6291B872A182CA87E7A4DF14C848B3E7BAAFF45F50F514139EA5A467D0DB38E540CB50
                                                                                                                                                                                                                                                        Function 00007FF70568DEF0 Relevance: 2.6, Strings: 2, Instructions: 144COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2506127906.00007FF705671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF705670000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506100994.00007FF705670000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506163767.00007FF70569B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506256106.00007FF7056B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff705670000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                                                        • String ID: e+000$gfff
                                                                                                                                                                                                                                                        • API String ID: 0-3030954782
                                                                                                                                                                                                                                                        • Opcode ID: c8a24eaff8c968987b4d031b15ae93849e98bcf9eddb8930961e84febef9b5bc
                                                                                                                                                                                                                                                        • Instruction ID: 54c32fbdcbe2cc51d9f12a740f34d4dbb679fc97b00f988a0164a9ef25a911be
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: c8a24eaff8c968987b4d031b15ae93849e98bcf9eddb8930961e84febef9b5bc
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: F4515862B182C186E7259E359C01779EB96EB44F94F888731EB984BBD5CF3ED440C721
                                                                                                                                                                                                                                                        Function 00007FF70568DA5C Relevance: 1.5, Strings: 1, Instructions: 254COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2506127906.00007FF705671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF705670000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506100994.00007FF705670000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506163767.00007FF70569B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506256106.00007FF7056B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff705670000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                                                        • String ID: gfffffff
                                                                                                                                                                                                                                                        • API String ID: 0-1523873471
                                                                                                                                                                                                                                                        • Opcode ID: bcab6200947a377332474fa44b4677218d40dcace4b26705986274372b0e4f91
                                                                                                                                                                                                                                                        • Instruction ID: 6949eb9589573e88f2b54c5cfebc9bfc67c7ca1a34edb446e4a3d2a1014fe5de
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: bcab6200947a377332474fa44b4677218d40dcace4b26705986274372b0e4f91
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 99A136A2A0878986EB21DF25A8007BDBBA6AF50F84F448232EE4D477C5DF3DD401C720
                                                                                                                                                                                                                                                        Function 00007FF705688794 Relevance: 1.4, Strings: 1, Instructions: 177COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2506127906.00007FF705671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF705670000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506100994.00007FF705670000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506163767.00007FF70569B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506256106.00007FF7056B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff705670000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                                        • String ID: TMP
                                                                                                                                                                                                                                                        • API String ID: 3215553584-3125297090
                                                                                                                                                                                                                                                        • Opcode ID: 09cdd7cf7fc9e7e425d724a32e8c9d3bd5c12dba7606eca5b930980d9b4d1239
                                                                                                                                                                                                                                                        • Instruction ID: fb3699b4bc5e054cb7e972dcae0f6285879f6fcd63e6fe477d978a048cf74cd7
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 09cdd7cf7fc9e7e425d724a32e8c9d3bd5c12dba7606eca5b930980d9b4d1239
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 4651A251F1860381FEA4BB269D1117AD292AF44FD4FD94A35FE2E47796EF3CE4428220
                                                                                                                                                                                                                                                        Function 00007FF705693480 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2506127906.00007FF705671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF705670000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506100994.00007FF705670000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506163767.00007FF70569B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506256106.00007FF7056B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff705670000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: HeapProcess
                                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                                        • API String ID: 54951025-0
                                                                                                                                                                                                                                                        • Opcode ID: 1f9e0516fd534d967cb731c121838b59470578846d262458ea046ba55ab40ebf
                                                                                                                                                                                                                                                        • Instruction ID: 9b3ba17700b041302dce806c0471c60b129b5db74fd7b575ccbb98f362e28409
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 1f9e0516fd534d967cb731c121838b59470578846d262458ea046ba55ab40ebf
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 72B09220F0BA02C2FE193B216C82228A2AABF48F00FD80178D00C40330DF3C24E55720
                                                                                                                                                                                                                                                        Function 00007FF7056835A0 Relevance: .3, Instructions: 327COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2506127906.00007FF705671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF705670000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506100994.00007FF705670000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506163767.00007FF70569B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506256106.00007FF7056B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff705670000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                                                        • Opcode ID: 5eca4e5ff3e7205525bf20f3b63783aa462e3e7adb0228d62bb7e98ab9f5e9bb
                                                                                                                                                                                                                                                        • Instruction ID: afcf17a95ff927120ce6aa130963c4b328d22332a9f9c88c535d0e3dd718a79f
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 5eca4e5ff3e7205525bf20f3b63783aa462e3e7adb0228d62bb7e98ab9f5e9bb
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 41D1C572B08642C6EB68AE298C5027DA7A2EF05F48F944B35EE0D07795DF3DD885C760
                                                                                                                                                                                                                                                        Function 00007FF705679800 Relevance: .3, Instructions: 287COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2506127906.00007FF705671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF705670000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506100994.00007FF705670000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506163767.00007FF70569B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506256106.00007FF7056B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff705670000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                                                        • Opcode ID: e75d751cc15dfd510e55d83c6141b0e8cb11d18cbed01e0c543b372a0114c593
                                                                                                                                                                                                                                                        • Instruction ID: 113e3f52615dbeb0d044ab8400d3ae276894252514896f7c8f7e4f792bab8a58
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: e75d751cc15dfd510e55d83c6141b0e8cb11d18cbed01e0c543b372a0114c593
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: F8C19E762181E08BD289EB29E86947A73E1FB8930DBD5406BEF87477C5C73CA414DB20
                                                                                                                                                                                                                                                        Function 00007FF705682C10 Relevance: .2, Instructions: 241COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2506127906.00007FF705671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF705670000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506100994.00007FF705670000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506163767.00007FF70569B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506256106.00007FF7056B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff705670000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                                                        • Opcode ID: aa73bfa000bc8cd66a05f12d530b76a597660d7bda6a6781f52cf2f49ffced0b
                                                                                                                                                                                                                                                        • Instruction ID: 98ee01d82fea646d3e47a5fcc96933e39b7ea1023a3e78ea8f80a09a30033644
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: aa73bfa000bc8cd66a05f12d530b76a597660d7bda6a6781f52cf2f49ffced0b
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: AFB19D7A908785C5E7649F29C8A423CBBA2FB49F48FA44236EB4E47395CF39D441C724
                                                                                                                                                                                                                                                        Function 00007FF70568E570 Relevance: .2, Instructions: 198COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2506127906.00007FF705671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF705670000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506100994.00007FF705670000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506163767.00007FF70569B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506256106.00007FF7056B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff705670000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                                                        • Opcode ID: 9611c2e0762efa78d7f6da3d8515592aa8d86601c49200b7335873453b670326
                                                                                                                                                                                                                                                        • Instruction ID: e979e21aceb544fe4dcbb0054ee5a2779f650b2851bab2a56856702ab5eb944e
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 9611c2e0762efa78d7f6da3d8515592aa8d86601c49200b7335873453b670326
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: B881D472A0C78186E774DB19984037AA696FF45F94F944335EA8D43B99DF3EE8408B10
                                                                                                                                                                                                                                                        Function 00007FF705696418 Relevance: .2, Instructions: 183COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2506127906.00007FF705671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF705670000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506100994.00007FF705670000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506163767.00007FF70569B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506256106.00007FF7056B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff705670000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                                        • API String ID: 3215553584-0
                                                                                                                                                                                                                                                        • Opcode ID: 403f67b08c5d8b9127b9d27d37b93e2a1e0a746a19683c5483168a42cc689f1f
                                                                                                                                                                                                                                                        • Instruction ID: 093e3ac6758cd622b9fea581ee2cd000e8d4b7a99584090821d7ee53a9d961b0
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 403f67b08c5d8b9127b9d27d37b93e2a1e0a746a19683c5483168a42cc689f1f
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 57612672E1838246FB74AA68DC1063DE68AAF40F64F944379F61E43AD5DF7DE8408720
                                                                                                                                                                                                                                                        Function 00007FF705681D54 Relevance: .1, Instructions: 146COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2506127906.00007FF705671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF705670000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506100994.00007FF705670000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506163767.00007FF70569B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506256106.00007FF7056B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff705670000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                                                        • Opcode ID: 27099d1c67046ba5536a5c52bb1b19252402c8bb4a5167aa336477e7b6d5f807
                                                                                                                                                                                                                                                        • Instruction ID: 688859cc88dd3fb02edf3be029d2fcad08c84f3a63df38f1e8d4c6280b31fd24
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 27099d1c67046ba5536a5c52bb1b19252402c8bb4a5167aa336477e7b6d5f807
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 1151A376A18A51C2E7249B29D844338B3A2EF4AF68F644331EE4D17794CB3AE853C750
                                                                                                                                                                                                                                                        Function 00007FF705682164 Relevance: .1, Instructions: 146COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2506127906.00007FF705671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF705670000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506100994.00007FF705670000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506163767.00007FF70569B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506256106.00007FF7056B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff705670000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                                                        • Opcode ID: 8e69dfdcc94a0aa650623f7423aa354004c1f2fa01d5c1268249020d4c21f447
                                                                                                                                                                                                                                                        • Instruction ID: 5d9da004ed31e3b6682767b050ceede2b3872e7be5ae003d6d395d234b1762f2
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 8e69dfdcc94a0aa650623f7423aa354004c1f2fa01d5c1268249020d4c21f447
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 5A51527AA18651C6E7649B29C86423CA3A2FF54F68F744231EF8D17794CB3AE843C750
                                                                                                                                                                                                                                                        Function 00007FF705681944 Relevance: .1, Instructions: 146COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2506127906.00007FF705671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF705670000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506100994.00007FF705670000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506163767.00007FF70569B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506256106.00007FF7056B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff705670000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                                                        • Opcode ID: 68a3f5aab59b2fac328bd6ba34d5b1cd1fa94c6914f84dc4a79da3b9d8ff9a98
                                                                                                                                                                                                                                                        • Instruction ID: 4295495219c242dce9fbcbdc1aec9d421f34a4fe3c63f90126d8e2ef4ff71f53
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 68a3f5aab59b2fac328bd6ba34d5b1cd1fa94c6914f84dc4a79da3b9d8ff9a98
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 8051B476A18651C6EB249B29C440238B7A2EF46F68F644331EE9D17794CF3AEC43C750
                                                                                                                                                                                                                                                        Function 00007FF705681F60 Relevance: .1, Instructions: 145COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2506127906.00007FF705671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF705670000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506100994.00007FF705670000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506163767.00007FF70569B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506256106.00007FF7056B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff705670000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                                                        • Opcode ID: e734bc54909bdf7d9c6fd1772be64da5dc64d4f5bf3044a39ac3ba7850561882
                                                                                                                                                                                                                                                        • Instruction ID: ffc0ac1eef682bcd90933ee72487c7113c57a2db5a76f5dac717cd8ab9eaf464
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: e734bc54909bdf7d9c6fd1772be64da5dc64d4f5bf3044a39ac3ba7850561882
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 4951A23AA18651C6E7249B29C85423CB7E2EF45F58FA44231EE4D177A5CF3AE843C750
                                                                                                                                                                                                                                                        Function 00007FF705681740 Relevance: .1, Instructions: 145COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2506127906.00007FF705671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF705670000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506100994.00007FF705670000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506163767.00007FF70569B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506256106.00007FF7056B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff705670000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                                                        • Opcode ID: 3943df286285c50b07f09d339b53caaa0afa34ddfac4fad96d8a3f7ffd6ad23b
                                                                                                                                                                                                                                                        • Instruction ID: 0a5b12acad4301a3da2e645869fdb7902b22ea9a5b5ff62c274c6fc790115037
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 3943df286285c50b07f09d339b53caaa0afa34ddfac4fad96d8a3f7ffd6ad23b
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 4851D376A18A51C6E7649B29C440638B7A2EF46F58FA44235EE4C17794CF3AE843C790
                                                                                                                                                                                                                                                        Function 00007FF705681B50 Relevance: .1, Instructions: 145COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2506127906.00007FF705671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF705670000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506100994.00007FF705670000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506163767.00007FF70569B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506256106.00007FF7056B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff705670000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                                                        • Opcode ID: dc981bf603441a130e1c6ba5e96f77be0c3c60e19ec03e3d560a09712d731568
                                                                                                                                                                                                                                                        • Instruction ID: 4cbacec17014712d1c13eb9f819831845db9620bac0164437448609089721eea
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: dc981bf603441a130e1c6ba5e96f77be0c3c60e19ec03e3d560a09712d731568
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 1951B576A18A51C6E7249F29C440338B7A2EF86F58FA85231EE4D17794DF3AE843C750
                                                                                                                                                                                                                                                        Function 00007FF705685D30 Relevance: .1, Instructions: 138COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2506127906.00007FF705671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF705670000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506100994.00007FF705670000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506163767.00007FF70569B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506256106.00007FF7056B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff705670000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                                                        • Opcode ID: dde3b7cfbcf26fc8d7513faefc9a59c4b8821272907dfbb35b6db6355186da00
                                                                                                                                                                                                                                                        • Instruction ID: c62dec06b0c0d7d054346f92f82351e161d68a478e473c2a9e965205a9bdc536
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: dde3b7cfbcf26fc8d7513faefc9a59c4b8821272907dfbb35b6db6355186da00
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 9941967280D74AD5E9A9A9180D086B49A82DF32FA0DD853B4FD9F173D3CF0D6986C321
                                                                                                                                                                                                                                                        Function 00007FF705689EA0 Relevance: .1, Instructions: 126COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2506127906.00007FF705671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF705670000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506100994.00007FF705670000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506163767.00007FF70569B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506256106.00007FF7056B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff705670000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: ErrorFreeHeapLast
                                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                                        • API String ID: 485612231-0
                                                                                                                                                                                                                                                        • Opcode ID: 1c7003d4bfacf113f63307708dabd17e5ede6cda44dccf6aa27d02a6b9ea0481
                                                                                                                                                                                                                                                        • Instruction ID: 6283482501cafdd38786763315f4f5670882dd9c1b62b65f93d2b339ffa8d661
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 1c7003d4bfacf113f63307708dabd17e5ede6cda44dccf6aa27d02a6b9ea0481
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: F6410022714A5582EF08DF6ADA24579B3A6BB48FD4B899133EE0D97B58DF3DC4428300
                                                                                                                                                                                                                                                        Function 00007FF7056880E4 Relevance: .1, Instructions: 98COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2506127906.00007FF705671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF705670000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506100994.00007FF705670000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506163767.00007FF70569B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506256106.00007FF7056B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff705670000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                                                        • Opcode ID: 2b8cddb4ee5dd57f1c7573491c8f445712dd312cb7e9e547cfd0f9c072f4c0c7
                                                                                                                                                                                                                                                        • Instruction ID: 65c6f77a84b13276b45c4a9a0a07ddab174f7551d8f73f2051b08b1d7d9976b1
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 2b8cddb4ee5dd57f1c7573491c8f445712dd312cb7e9e547cfd0f9c072f4c0c7
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: BD31B432719B4281E764AF25AC4017DA6DAAF85FE0F944238FA9D53BD6DF3CE0018714
                                                                                                                                                                                                                                                        Function 00007FF705699570 Relevance: .0, Instructions: 32COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2506127906.00007FF705671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF705670000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506100994.00007FF705670000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506163767.00007FF70569B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506256106.00007FF7056B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff705670000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                                                        • Opcode ID: 5d3ac10822f6242d2b374fc0e1218152d8e80c351f0dfcd4fab21387456caa74
                                                                                                                                                                                                                                                        • Instruction ID: 94245fd89eff408731d2ab3a7c39402034109aba79b656bdd326b480479e0264
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 5d3ac10822f6242d2b374fc0e1218152d8e80c351f0dfcd4fab21387456caa74
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 4EF068717182A58BEB989F6DA80262A77D1FB08BC0FC48539E58D83B04DB3CD0918F14
                                                                                                                                                                                                                                                        Function 00007FF70567D30C Relevance: .0, Instructions: 2COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2506127906.00007FF705671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF705670000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506100994.00007FF705670000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506163767.00007FF70569B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506256106.00007FF7056B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff705670000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                                                        • Opcode ID: 3c3909751b2697c6481bc0460501d6177e5cf72f77169ad8285d6e0cd944102a
                                                                                                                                                                                                                                                        • Instruction ID: 294d960e7c4920be74c01c1beda18a7d097be1441a9a8308ca9ad6b78e676fb6
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 3c3909751b2697c6481bc0460501d6177e5cf72f77169ad8285d6e0cd944102a
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: A0A0012190C80AD0E654EB00AC90035A336FF55F14BC00472F00D650B49F2CA4049260
                                                                                                                                                                                                                                                        Function 00007FF705675830 Relevance: 229.6, APIs: 86, Strings: 45, Instructions: 400libraryloaderCOMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        • GetProcAddress.KERNEL32(?,00007FF7056764CF,?,00007FF70567336E), ref: 00007FF705675840
                                                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,00007FF7056764CF,?,00007FF70567336E), ref: 00007FF705675852
                                                                                                                                                                                                                                                        • GetProcAddress.KERNEL32(?,00007FF7056764CF,?,00007FF70567336E), ref: 00007FF705675889
                                                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,00007FF7056764CF,?,00007FF70567336E), ref: 00007FF70567589B
                                                                                                                                                                                                                                                        • GetProcAddress.KERNEL32(?,00007FF7056764CF,?,00007FF70567336E), ref: 00007FF7056758B4
                                                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,00007FF7056764CF,?,00007FF70567336E), ref: 00007FF7056758C6
                                                                                                                                                                                                                                                        • GetProcAddress.KERNEL32(?,00007FF7056764CF,?,00007FF70567336E), ref: 00007FF7056758DF
                                                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,00007FF7056764CF,?,00007FF70567336E), ref: 00007FF7056758F1
                                                                                                                                                                                                                                                        • GetProcAddress.KERNEL32(?,00007FF7056764CF,?,00007FF70567336E), ref: 00007FF70567590D
                                                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,00007FF7056764CF,?,00007FF70567336E), ref: 00007FF70567591F
                                                                                                                                                                                                                                                        • GetProcAddress.KERNEL32(?,00007FF7056764CF,?,00007FF70567336E), ref: 00007FF70567593B
                                                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,00007FF7056764CF,?,00007FF70567336E), ref: 00007FF70567594D
                                                                                                                                                                                                                                                        • GetProcAddress.KERNEL32(?,00007FF7056764CF,?,00007FF70567336E), ref: 00007FF705675969
                                                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,00007FF7056764CF,?,00007FF70567336E), ref: 00007FF70567597B
                                                                                                                                                                                                                                                        • GetProcAddress.KERNEL32(?,00007FF7056764CF,?,00007FF70567336E), ref: 00007FF705675997
                                                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,00007FF7056764CF,?,00007FF70567336E), ref: 00007FF7056759A9
                                                                                                                                                                                                                                                        • GetProcAddress.KERNEL32(?,00007FF7056764CF,?,00007FF70567336E), ref: 00007FF7056759C5
                                                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,00007FF7056764CF,?,00007FF70567336E), ref: 00007FF7056759D7
                                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2506127906.00007FF705671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF705670000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506100994.00007FF705670000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506163767.00007FF70569B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506256106.00007FF7056B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff705670000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: AddressErrorLastProc
                                                                                                                                                                                                                                                        • String ID: Failed to get address for %hs$GetProcAddress$PyConfig_Clear$PyConfig_InitIsolatedConfig$PyConfig_Read$PyConfig_SetBytesString$PyConfig_SetString$PyConfig_SetWideStringList$PyErr_Clear$PyErr_Fetch$PyErr_NormalizeException$PyErr_Occurred$PyErr_Print$PyErr_Restore$PyEval_EvalCode$PyImport_AddModule$PyImport_ExecCodeModule$PyImport_ImportModule$PyMarshal_ReadObjectFromString$PyMem_RawFree$PyModule_GetDict$PyObject_CallFunction$PyObject_CallFunctionObjArgs$PyObject_GetAttrString$PyObject_SetAttrString$PyObject_Str$PyPreConfig_InitIsolatedConfig$PyRun_SimpleStringFlags$PyStatus_Exception$PySys_GetObject$PySys_SetObject$PyUnicode_AsUTF8$PyUnicode_Decode$PyUnicode_DecodeFSDefault$PyUnicode_FromFormat$PyUnicode_FromString$PyUnicode_Join$PyUnicode_Replace$Py_DecRef$Py_DecodeLocale$Py_ExitStatusException$Py_Finalize$Py_InitializeFromConfig$Py_IsInitialized$Py_PreInitialize
                                                                                                                                                                                                                                                        • API String ID: 199729137-653951865
                                                                                                                                                                                                                                                        • Opcode ID: a72b1b0889ffc37889110ad0e4f068dcb4eb8b0bbe2e77bf2d8672c26fae6e03
                                                                                                                                                                                                                                                        • Instruction ID: a5882140a97ac7e6cd9fa7b44f12510a7d54d2380f556a8395276243139578c6
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: a72b1b0889ffc37889110ad0e4f068dcb4eb8b0bbe2e77bf2d8672c26fae6e03
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: C522A174A0DB0B92FA54FB55BC205B4A3AAAF55F51FD410B6F41F02260EF3CB999D220
                                                                                                                                                                                                                                                        Function 00007FF7056781D0 Relevance: 24.6, APIs: 6, Strings: 8, Instructions: 117COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                          • Part of subcall function 00007FF705679390: MultiByteToWideChar.KERNEL32(?,?,?,00007FF7056745F4,00000000,00007FF705671985), ref: 00007FF7056793C9
                                                                                                                                                                                                                                                        • ExpandEnvironmentStringsW.KERNEL32(?,00007FF7056786B7,?,?,00000000,00007FF705673CBB), ref: 00007FF70567822C
                                                                                                                                                                                                                                                          • Part of subcall function 00007FF705672810: MessageBoxW.USER32 ref: 00007FF7056728EA
                                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2506127906.00007FF705671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF705670000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506100994.00007FF705670000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506163767.00007FF70569B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506256106.00007FF7056B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff705670000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: ByteCharEnvironmentExpandMessageMultiStringsWide
                                                                                                                                                                                                                                                        • String ID: %.*s$CreateDirectory$LOADER: failed to convert runtime-tmpdir to a wide string.$LOADER: failed to create runtime-tmpdir path %ls!$LOADER: failed to expand environment variables in the runtime-tmpdir.$LOADER: failed to obtain the absolute path of the runtime-tmpdir.$LOADER: runtime-tmpdir points to non-existent drive %ls (type: %d)!$\
                                                                                                                                                                                                                                                        • API String ID: 1662231829-930877121
                                                                                                                                                                                                                                                        • Opcode ID: 9187bed43bf71c5340eadf58a1920dd2feb36a2730cc38c17813087cef3183ed
                                                                                                                                                                                                                                                        • Instruction ID: 4b0b7f59af12b1362538360d0c41c56a3a780a44fd8be27854e4de88be33ed8d
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 9187bed43bf71c5340eadf58a1920dd2feb36a2730cc38c17813087cef3183ed
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: E8518421A2C64681FB60FB65EC552B9E366EF94F84FD44431F60E476D5EF2CE9048360
                                                                                                                                                                                                                                                        Function 00007FF705672180 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 120COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2506127906.00007FF705671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF705670000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506100994.00007FF705670000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506163767.00007FF70569B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506256106.00007FF7056B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff705670000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: MoveWindow$ObjectSelect$DrawReleaseText
                                                                                                                                                                                                                                                        • String ID: P%
                                                                                                                                                                                                                                                        • API String ID: 2147705588-2959514604
                                                                                                                                                                                                                                                        • Opcode ID: 044398bc2faddcfc72e28419b1c607044beef288ba0900b5e0371f537bcab75f
                                                                                                                                                                                                                                                        • Instruction ID: 4a19d56f0d9566f8e0e8e104f827e0b5aaea364a22c02bbfe01cd595b8f4960a
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 044398bc2faddcfc72e28419b1c607044beef288ba0900b5e0371f537bcab75f
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 8A51E8666087A186D6349F26F8181BAF7A2FB98F61F404125EFDE43694DF3CD085DB20
                                                                                                                                                                                                                                                        Function 00007FF7056780C0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 67COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2506127906.00007FF705671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF705670000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506100994.00007FF705670000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506163767.00007FF70569B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506256106.00007FF7056B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff705670000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: LongWindow$BlockCreateErrorLastReasonShutdown
                                                                                                                                                                                                                                                        • String ID: Needs to remove its temporary files.
                                                                                                                                                                                                                                                        • API String ID: 3975851968-2863640275
                                                                                                                                                                                                                                                        • Opcode ID: fca9629812ae98fc4dea80e51924cd1fa5b6a95a0379263e815d251d6ca0a567
                                                                                                                                                                                                                                                        • Instruction ID: 88069edc403ff0066d28de0852a3298d6a25a5aed4bf7c0092b7d9fe7a1570d1
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: fca9629812ae98fc4dea80e51924cd1fa5b6a95a0379263e815d251d6ca0a567
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: D5218821B0CA4781EB41EB7AFC58179A356FF84F90F984271EA1D433E4DF2CD9518221
                                                                                                                                                                                                                                                        Function 00007FF705686290 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 494COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2506127906.00007FF705671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF705670000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506100994.00007FF705670000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506163767.00007FF70569B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506256106.00007FF7056B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff705670000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                                        • String ID: -$:$f$p$p
                                                                                                                                                                                                                                                        • API String ID: 3215553584-2013873522
                                                                                                                                                                                                                                                        • Opcode ID: 75ce3dd5e90789a751ac91fed3db50e3550f512a2f4dec46f6fb30c565ad9a60
                                                                                                                                                                                                                                                        • Instruction ID: 0c14d09328eaf5a4c5641279c04856f8d12407a91069581d31dd6f2c48010f13
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 75ce3dd5e90789a751ac91fed3db50e3550f512a2f4dec46f6fb30c565ad9a60
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 82128F62E08283C6FB607A14D95467AF6A3FF60F54FC44235F69A46AC4DF7CE5808B21
                                                                                                                                                                                                                                                        Function 00007FF705680FC8 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 475COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2506127906.00007FF705671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF705670000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506100994.00007FF705670000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506163767.00007FF70569B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506256106.00007FF7056B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff705670000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                                        • String ID: f$f$p$p$f
                                                                                                                                                                                                                                                        • API String ID: 3215553584-1325933183
                                                                                                                                                                                                                                                        • Opcode ID: efdc55b57c7b5823aa39a5abe82f144bbffe385c3037011f7a836833ec2ff017
                                                                                                                                                                                                                                                        • Instruction ID: 0ef8a7b79b6cfeefbaf3daae95ec884378c475969b0b3f9f8b4837969bed445d
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: efdc55b57c7b5823aa39a5abe82f144bbffe385c3037011f7a836833ec2ff017
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 831272A1E0C143C6FB206A14E8546B9F6A3FF42F54FD44235F69A46AC4DB7CE486CB21
                                                                                                                                                                                                                                                        Function 00007FF705671050 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 119COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2506127906.00007FF705671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF705670000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506100994.00007FF705670000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506163767.00007FF70569B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506256106.00007FF7056B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff705670000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: CurrentProcess
                                                                                                                                                                                                                                                        • String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
                                                                                                                                                                                                                                                        • API String ID: 2050909247-3659356012
                                                                                                                                                                                                                                                        • Opcode ID: bdb51f189eec0aae26590c8a1b92bbb562030306dab734aaada4990c27a5542a
                                                                                                                                                                                                                                                        • Instruction ID: 2a04dd1071df8dc2b3db01344336fecd044d6511f7f526ca96d3ac301c335913
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: bdb51f189eec0aae26590c8a1b92bbb562030306dab734aaada4990c27a5542a
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 81415A21A1865682EA10FB12AC046BAE396BF86FC4FD44532FD4C4B796DF3CE545C760
                                                                                                                                                                                                                                                        Function 00007FF705671470 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 107COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2506127906.00007FF705671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF705670000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506100994.00007FF705670000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506163767.00007FF70569B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506256106.00007FF7056B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff705670000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: CurrentProcess
                                                                                                                                                                                                                                                        • String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
                                                                                                                                                                                                                                                        • API String ID: 2050909247-3659356012
                                                                                                                                                                                                                                                        • Opcode ID: a8e221c47165c0dbec1a7dc4007f346f16716469ebf4d834264a8452580f1fe3
                                                                                                                                                                                                                                                        • Instruction ID: 0dc86d2a97798cb6aa680e2e39c2f93279d26ca2ee9b3b4e097a47f64ade0acf
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: a8e221c47165c0dbec1a7dc4007f346f16716469ebf4d834264a8452580f1fe3
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 8E417C61A1864686EA10EB21EC401B9E392EF45F94FC44532FD4D07B95DF3CE546C720
                                                                                                                                                                                                                                                        Function 00007FF70567EA08 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 310COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2506127906.00007FF705671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF705670000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506100994.00007FF705670000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506163767.00007FF70569B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506256106.00007FF7056B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff705670000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
                                                                                                                                                                                                                                                        • String ID: csm$csm$csm
                                                                                                                                                                                                                                                        • API String ID: 849930591-393685449
                                                                                                                                                                                                                                                        • Opcode ID: aab7c7e636ea8a2572919ef13f94062ff4905efd63cd4babadd9079b892b9703
                                                                                                                                                                                                                                                        • Instruction ID: 6693751607b9646e4400df1b7d269d4530bdccd7a756c5399e96b5089339234c
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: aab7c7e636ea8a2572919ef13f94062ff4905efd63cd4babadd9079b892b9703
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 18D18C22A0874986EB20EB35D8403ADB7A5FF45F88F900535EE4D57B96CF39E998C710
                                                                                                                                                                                                                                                        Function 00007FF705672C50 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 104windowCOMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        • GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF705673706,?,00007FF705673804), ref: 00007FF705672C9E
                                                                                                                                                                                                                                                        • FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF705673706,?,00007FF705673804), ref: 00007FF705672D63
                                                                                                                                                                                                                                                        • MessageBoxW.USER32 ref: 00007FF705672D99
                                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2506127906.00007FF705671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF705670000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506100994.00007FF705670000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506163767.00007FF70569B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506256106.00007FF7056B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff705670000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: Message$CurrentFormatProcess
                                                                                                                                                                                                                                                        • String ID: %ls: $<FormatMessageW failed.>$Error$[PYI-%d:ERROR]
                                                                                                                                                                                                                                                        • API String ID: 3940978338-251083826
                                                                                                                                                                                                                                                        • Opcode ID: c67c27f58c2af476bbbd059d0433c12e6f67668a4e3ecf6e42cf1bc8669f0b6b
                                                                                                                                                                                                                                                        • Instruction ID: e909f3f73ae8f3dad52fc818d04d69260d92f9039549fa49e5dfa896927824cb
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: c67c27f58c2af476bbbd059d0433c12e6f67668a4e3ecf6e42cf1bc8669f0b6b
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: F131B626708A4542E720FB25BC146AAA796BF88F98F810136FF4D53759EF3CD646C710
                                                                                                                                                                                                                                                        Function 00007FF70567DCC8 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        • LoadLibraryExW.KERNEL32(?,?,?,00007FF70567DF7A,?,?,?,00007FF70567DC6C,?,?,?,00007FF70567D869), ref: 00007FF70567DD4D
                                                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,?,?,00007FF70567DF7A,?,?,?,00007FF70567DC6C,?,?,?,00007FF70567D869), ref: 00007FF70567DD5B
                                                                                                                                                                                                                                                        • LoadLibraryExW.KERNEL32(?,?,?,00007FF70567DF7A,?,?,?,00007FF70567DC6C,?,?,?,00007FF70567D869), ref: 00007FF70567DD85
                                                                                                                                                                                                                                                        • FreeLibrary.KERNEL32(?,?,?,00007FF70567DF7A,?,?,?,00007FF70567DC6C,?,?,?,00007FF70567D869), ref: 00007FF70567DDF3
                                                                                                                                                                                                                                                        • GetProcAddress.KERNEL32(?,?,?,00007FF70567DF7A,?,?,?,00007FF70567DC6C,?,?,?,00007FF70567D869), ref: 00007FF70567DDFF
                                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2506127906.00007FF705671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF705670000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506100994.00007FF705670000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506163767.00007FF70569B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506256106.00007FF7056B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff705670000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: Library$Load$AddressErrorFreeLastProc
                                                                                                                                                                                                                                                        • String ID: api-ms-
                                                                                                                                                                                                                                                        • API String ID: 2559590344-2084034818
                                                                                                                                                                                                                                                        • Opcode ID: 276526191d17588ee9fa22b972cdf0953455baf5c8a53fb276b347519b5968a9
                                                                                                                                                                                                                                                        • Instruction ID: b080119c4d35d80519a348017ac501c05f3bcb793dd436f940f4441fbdfdee4b
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 276526191d17588ee9fa22b972cdf0953455baf5c8a53fb276b347519b5968a9
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 1F31AF61B1A64691EE12EB02AC005B5A3AAFF48FA4FD94935FD2D46390EF3CE5448720
                                                                                                                                                                                                                                                        Function 00007FF705676360 Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 82COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2506127906.00007FF705671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF705670000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506100994.00007FF705670000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506163767.00007FF70569B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506256106.00007FF7056B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff705670000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: CurrentProcess
                                                                                                                                                                                                                                                        • String ID: Failed to load Python DLL '%ls'.$LoadLibrary$Path of Python shared library (%s) and its name (%s) exceed buffer size (%d)$Path of ucrtbase.dll (%s) and its name exceed buffer size (%d)$Reported length (%d) of Python shared library name (%s) exceeds buffer size (%d)$ucrtbase.dll
                                                                                                                                                                                                                                                        • API String ID: 2050909247-2434346643
                                                                                                                                                                                                                                                        • Opcode ID: bd35b640c02035bc0e077a05b147b005ab0e639f37cafda848bc65a29b3ec2f1
                                                                                                                                                                                                                                                        • Instruction ID: 298b3bceec67563a302378de89e4bcb2d75ace23ca55c4bd455bb48ee8f82b84
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: bd35b640c02035bc0e077a05b147b005ab0e639f37cafda848bc65a29b3ec2f1
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 6841A131A18A8A91FA11FB20EC142E9A356FF54F44FD04232FA5D43299EF3CE959C360
                                                                                                                                                                                                                                                        Function 00007FF705672A50 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 64COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        • GetCurrentProcessId.KERNEL32(00000000,?,?,?,00000000,00007FF70567351A,?,00000000,00007FF705673F23), ref: 00007FF705672AA0
                                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2506127906.00007FF705671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF705670000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506100994.00007FF705670000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506163767.00007FF70569B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506256106.00007FF7056B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff705670000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: CurrentProcess
                                                                                                                                                                                                                                                        • String ID: 0$WARNING$Warning$Warning [ANSI Fallback]$[PYI-%d:%s]
                                                                                                                                                                                                                                                        • API String ID: 2050909247-2900015858
                                                                                                                                                                                                                                                        • Opcode ID: d3ff72078d09a899d0ca032b5bdbc8691629937d026b54217f09319e947088a3
                                                                                                                                                                                                                                                        • Instruction ID: 1b022f0b39561114f2240d40869c19c35d8150b4f34f99e0806839c89b6357ba
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: d3ff72078d09a899d0ca032b5bdbc8691629937d026b54217f09319e947088a3
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 7D218E32A19B8192E720EB51B8917EAA399FF88F84F800136FE8D53659DF3CD645C750
                                                                                                                                                                                                                                                        Function 00007FF70568B150 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2506127906.00007FF705671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF705670000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506100994.00007FF705670000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506163767.00007FF70569B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506256106.00007FF7056B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff705670000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: Value$ErrorLast
                                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                                        • API String ID: 2506987500-0
                                                                                                                                                                                                                                                        • Opcode ID: a42b9cf7ed1ffe71ebcf97f5a72f2c90d2921d4b6bb9ef7954fc9d2fe8c6feaf
                                                                                                                                                                                                                                                        • Instruction ID: 140557bad692a44dbcf371fd87e582b8f0ef56434731861a099aca0394e86ff9
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: a42b9cf7ed1ffe71ebcf97f5a72f2c90d2921d4b6bb9ef7954fc9d2fe8c6feaf
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 69214924B0C242C1FA687361AE6113DE2875F44FB0F844735F97E4AAE6DF2CB8408721
                                                                                                                                                                                                                                                        Function 00007FF705697D6C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2506127906.00007FF705671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF705670000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506100994.00007FF705670000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506163767.00007FF70569B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506256106.00007FF7056B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff705670000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
                                                                                                                                                                                                                                                        • String ID: CONOUT$
                                                                                                                                                                                                                                                        • API String ID: 3230265001-3130406586
                                                                                                                                                                                                                                                        • Opcode ID: 3755c2f75cb97972cd4ab37a7e27d28fd0bf6f95a56d27d10542fc75f089f0eb
                                                                                                                                                                                                                                                        • Instruction ID: cc5ad07fbf7ed7ef232b453fe2ca5cda46b5794c386e1a0e4028bf581827576a
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 3755c2f75cb97972cd4ab37a7e27d28fd0bf6f95a56d27d10542fc75f089f0eb
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: AB117F21A18A4186E760AB12BC54339B2A9FF88FE4F840234FA5D877A4DF7CD814C750
                                                                                                                                                                                                                                                        Function 00007FF705678ED0 Relevance: 9.1, APIs: 6, Instructions: 121COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        • GetCurrentProcess.KERNEL32(?,FFFFFFFF,00000000,00007FF705673FB1), ref: 00007FF705678EFD
                                                                                                                                                                                                                                                        • K32EnumProcessModules.KERNEL32(?,FFFFFFFF,00000000,00007FF705673FB1), ref: 00007FF705678F5A
                                                                                                                                                                                                                                                          • Part of subcall function 00007FF705679390: MultiByteToWideChar.KERNEL32(?,?,?,00007FF7056745F4,00000000,00007FF705671985), ref: 00007FF7056793C9
                                                                                                                                                                                                                                                        • K32GetModuleFileNameExW.KERNEL32(?,FFFFFFFF,00000000,00007FF705673FB1), ref: 00007FF705678FE5
                                                                                                                                                                                                                                                        • K32GetModuleFileNameExW.KERNEL32(?,FFFFFFFF,00000000,00007FF705673FB1), ref: 00007FF705679044
                                                                                                                                                                                                                                                        • FreeLibrary.KERNEL32(?,FFFFFFFF,00000000,00007FF705673FB1), ref: 00007FF705679055
                                                                                                                                                                                                                                                        • FreeLibrary.KERNEL32(?,FFFFFFFF,00000000,00007FF705673FB1), ref: 00007FF70567906A
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2506127906.00007FF705671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF705670000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506100994.00007FF705670000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506163767.00007FF70569B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506256106.00007FF7056B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff705670000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: FileFreeLibraryModuleNameProcess$ByteCharCurrentEnumModulesMultiWide
                                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                                        • API String ID: 3462794448-0
                                                                                                                                                                                                                                                        • Opcode ID: 0184f5a771bb2c28f933eba3e4018dda16e38d059dd6d010c17659477659ba58
                                                                                                                                                                                                                                                        • Instruction ID: d3822b51746bd7d662afe5099e99039866758c57935ce796a83d8999b2e0fb1a
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 0184f5a771bb2c28f933eba3e4018dda16e38d059dd6d010c17659477659ba58
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: CD419462A1968681EA30EB12A9006BAB7A6FF85FD4F840139FF5D57789DF3CD500C720
                                                                                                                                                                                                                                                        Function 00007FF70568B2C8 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,?,?,00007FF705684F11,?,?,?,?,00007FF70568A48A,?,?,?,?,00007FF70568718F), ref: 00007FF70568B2D7
                                                                                                                                                                                                                                                        • FlsSetValue.KERNEL32(?,?,?,00007FF705684F11,?,?,?,?,00007FF70568A48A,?,?,?,?,00007FF70568718F), ref: 00007FF70568B30D
                                                                                                                                                                                                                                                        • FlsSetValue.KERNEL32(?,?,?,00007FF705684F11,?,?,?,?,00007FF70568A48A,?,?,?,?,00007FF70568718F), ref: 00007FF70568B33A
                                                                                                                                                                                                                                                        • FlsSetValue.KERNEL32(?,?,?,00007FF705684F11,?,?,?,?,00007FF70568A48A,?,?,?,?,00007FF70568718F), ref: 00007FF70568B34B
                                                                                                                                                                                                                                                        • FlsSetValue.KERNEL32(?,?,?,00007FF705684F11,?,?,?,?,00007FF70568A48A,?,?,?,?,00007FF70568718F), ref: 00007FF70568B35C
                                                                                                                                                                                                                                                        • SetLastError.KERNEL32(?,?,?,00007FF705684F11,?,?,?,?,00007FF70568A48A,?,?,?,?,00007FF70568718F), ref: 00007FF70568B377
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2506127906.00007FF705671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF705670000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506100994.00007FF705670000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506163767.00007FF70569B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506256106.00007FF7056B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff705670000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: Value$ErrorLast
                                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                                        • API String ID: 2506987500-0
                                                                                                                                                                                                                                                        • Opcode ID: 1c08c83365d44066401784e1b70b71c7670d14ff4fb682678828c33d1612b477
                                                                                                                                                                                                                                                        • Instruction ID: 107335aa1c5bc4ca60d96bd470c6dbc8f821da730f73e0cc498aac2ebd1423de
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 1c08c83365d44066401784e1b70b71c7670d14ff4fb682678828c33d1612b477
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 78114A20B0C642C2FA687721AE9113DE2979F44FB0F844734F93E466E6DF2CA8418721
                                                                                                                                                                                                                                                        Function 00007FF705672910 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 86COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        • GetCurrentProcessId.KERNEL32(?,?,?,?,00000000,00000000,?,00000000,00007FF705671B6A), ref: 00007FF70567295E
                                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2506127906.00007FF705671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF705670000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506100994.00007FF705670000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506163767.00007FF70569B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506256106.00007FF7056B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff705670000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: CurrentProcess
                                                                                                                                                                                                                                                        • String ID: %s: %s$Error$Error [ANSI Fallback]$[PYI-%d:ERROR]
                                                                                                                                                                                                                                                        • API String ID: 2050909247-2962405886
                                                                                                                                                                                                                                                        • Opcode ID: b3354eec44a94607d33eb4f3788ab89374ba031f66333e1b118589dca889f3f3
                                                                                                                                                                                                                                                        • Instruction ID: c853cae29fb08d770bc722d004749bbe05585337275a2f9fca3b9b633ef42d02
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: b3354eec44a94607d33eb4f3788ab89374ba031f66333e1b118589dca889f3f3
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 3E31AF32A1868592E720E765BC506E6A396BF88FD8F800132FE8D83759EF3CD5468650
                                                                                                                                                                                                                                                        Function 00007FF705672390 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 81windowCOMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2506127906.00007FF705671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF705670000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506100994.00007FF705670000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506163767.00007FF70569B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506256106.00007FF7056B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff705670000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: DeleteDestroyDialogHandleIconIndirectModuleObjectParam
                                                                                                                                                                                                                                                        • String ID: Unhandled exception in script
                                                                                                                                                                                                                                                        • API String ID: 3081866767-2699770090
                                                                                                                                                                                                                                                        • Opcode ID: 851ce5d4a208b56cb63585478e484d0f9d6918564d04618497f061aba15d8534
                                                                                                                                                                                                                                                        • Instruction ID: b34eebaf82cd45bf0f5ab1b2effd7cbc504e8e1ae472bc3839a56ef38f128e55
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 851ce5d4a208b56cb63585478e484d0f9d6918564d04618497f061aba15d8534
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 7E31607661968285EB20EB61EC552F9A366FF88F88F840235FA4D47B59DF3CD144C710
                                                                                                                                                                                                                                                        Function 00007FF705672B50 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 65windowCOMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        • GetCurrentProcessId.KERNEL32(?,00000000,00000000,FFFFFFFF,00000000,00007FF70567918F,?,00007FF705673C55), ref: 00007FF705672BA0
                                                                                                                                                                                                                                                        • MessageBoxW.USER32 ref: 00007FF705672C2A
                                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2506127906.00007FF705671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF705670000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506100994.00007FF705670000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506163767.00007FF70569B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506256106.00007FF7056B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff705670000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: CurrentMessageProcess
                                                                                                                                                                                                                                                        • String ID: WARNING$Warning$[PYI-%d:%ls]
                                                                                                                                                                                                                                                        • API String ID: 1672936522-3797743490
                                                                                                                                                                                                                                                        • Opcode ID: 4a0b6e8ebe13cae449087f655af1d2523953ec7fd560ce9a50e7097f48d063a1
                                                                                                                                                                                                                                                        • Instruction ID: c634fc5c26b83e94d65e354e50160b896f8d586ac6901169a2c1ecac8d1d88a6
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 4a0b6e8ebe13cae449087f655af1d2523953ec7fd560ce9a50e7097f48d063a1
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 43219F62708B4192E710EB14F8547AAA3A6EF88F84F800136FA8D57659DF3CD655C750
                                                                                                                                                                                                                                                        Function 00007FF705672710 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 64COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        • GetCurrentProcessId.KERNEL32(?,00000000,00000000,?,00000000,00007FF705671B99), ref: 00007FF705672760
                                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2506127906.00007FF705671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF705670000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506100994.00007FF705670000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506163767.00007FF70569B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506256106.00007FF7056B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff705670000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: CurrentProcess
                                                                                                                                                                                                                                                        • String ID: ERROR$Error$Error [ANSI Fallback]$[PYI-%d:%s]
                                                                                                                                                                                                                                                        • API String ID: 2050909247-1591803126
                                                                                                                                                                                                                                                        • Opcode ID: a4fe537d534c2fb53088f6f6b76b448a80ccad2508d4dc842b27f1a8247accfc
                                                                                                                                                                                                                                                        • Instruction ID: 00b06bf57e4f746f349972bef13570b11f414a729f5a5e343ff9a0b2f70d9c77
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: a4fe537d534c2fb53088f6f6b76b448a80ccad2508d4dc842b27f1a8247accfc
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 4221AE32A18B8582E720EB50B8917E6A3A5FF88F84F800132FE8D43659DF3CD6498750
                                                                                                                                                                                                                                                        Function 00007FF705689A88 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2506127906.00007FF705671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF705670000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506100994.00007FF705670000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506163767.00007FF70569B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506256106.00007FF7056B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff705670000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: AddressFreeHandleLibraryModuleProc
                                                                                                                                                                                                                                                        • String ID: CorExitProcess$mscoree.dll
                                                                                                                                                                                                                                                        • API String ID: 4061214504-1276376045
                                                                                                                                                                                                                                                        • Opcode ID: b239dd027a539e56a716c05e535b4da9cb8e2339e08a4dc57142401ef2416000
                                                                                                                                                                                                                                                        • Instruction ID: 9cf33cbf12bd2373259a0450ffd19be0a01b436f86146062805900121321b34d
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: b239dd027a539e56a716c05e535b4da9cb8e2339e08a4dc57142401ef2416000
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 4EF0C261B0D70681EA10AB20FC9533AA322AF84F60FC40375E66E465F4CF2CD088C720
                                                                                                                                                                                                                                                        Function 00007FF705699368 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2506127906.00007FF705671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF705670000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506100994.00007FF705670000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506163767.00007FF70569B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506256106.00007FF7056B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff705670000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: _set_statfp
                                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                                        • API String ID: 1156100317-0
                                                                                                                                                                                                                                                        • Opcode ID: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
                                                                                                                                                                                                                                                        • Instruction ID: 575dc9201e56da8a376677a3a1ba686ad1321715e493da0948e3f8f6672bcb60
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: B111C432E5CA0301FB643565EC91379905AAF58F78E8806BCFA6E063D6CF6C68815220
                                                                                                                                                                                                                                                        Function 00007FF70568B390 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        • FlsGetValue.KERNEL32(?,?,?,00007FF70568A5A3,?,?,00000000,00007FF70568A83E,?,?,?,?,?,00007FF70568A7CA), ref: 00007FF70568B3AF
                                                                                                                                                                                                                                                        • FlsSetValue.KERNEL32(?,?,?,00007FF70568A5A3,?,?,00000000,00007FF70568A83E,?,?,?,?,?,00007FF70568A7CA), ref: 00007FF70568B3CE
                                                                                                                                                                                                                                                        • FlsSetValue.KERNEL32(?,?,?,00007FF70568A5A3,?,?,00000000,00007FF70568A83E,?,?,?,?,?,00007FF70568A7CA), ref: 00007FF70568B3F6
                                                                                                                                                                                                                                                        • FlsSetValue.KERNEL32(?,?,?,00007FF70568A5A3,?,?,00000000,00007FF70568A83E,?,?,?,?,?,00007FF70568A7CA), ref: 00007FF70568B407
                                                                                                                                                                                                                                                        • FlsSetValue.KERNEL32(?,?,?,00007FF70568A5A3,?,?,00000000,00007FF70568A83E,?,?,?,?,?,00007FF70568A7CA), ref: 00007FF70568B418
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2506127906.00007FF705671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF705670000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506100994.00007FF705670000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506163767.00007FF70569B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506256106.00007FF7056B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff705670000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: Value
                                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                                        • API String ID: 3702945584-0
                                                                                                                                                                                                                                                        • Opcode ID: 44f6b3e63c936746b9124b5af5da9c753e88c88086b63197a25bc1506e4861c0
                                                                                                                                                                                                                                                        • Instruction ID: fea468a673f8d3cebfd50f53291367dedebadc83ee1a4bf3fcd2df6a74da728e
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 44f6b3e63c936746b9124b5af5da9c753e88c88086b63197a25bc1506e4861c0
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 6B113D20F0D642C1FA58B7259D51179E1875F44FB0FC84334F93E4A7EADF2CA8428621
                                                                                                                                                                                                                                                        Function 00007FF70568B224 Relevance: 7.6, APIs: 5, Instructions: 50COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2506127906.00007FF705671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF705670000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506100994.00007FF705670000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506163767.00007FF70569B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506256106.00007FF7056B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff705670000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: Value
                                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                                        • API String ID: 3702945584-0
                                                                                                                                                                                                                                                        • Opcode ID: 92671db20a050c4f2636db97a8291f7b9cbb2c044339a59ef12305351f814945
                                                                                                                                                                                                                                                        • Instruction ID: 4dc73fac4a836091d0b6d76763bb633aebc652e32e5ca4fa8becf73dc1cdf44a
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 92671db20a050c4f2636db97a8291f7b9cbb2c044339a59ef12305351f814945
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: DE11E524E09207C5F96873615C6117EE1874F45F70F984B34FA3E4A6E2DF2DB8814632
                                                                                                                                                                                                                                                        Function 00007FF705685FA0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 242COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2506127906.00007FF705671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF705670000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506100994.00007FF705670000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506163767.00007FF70569B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506256106.00007FF7056B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff705670000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                                        • String ID: verbose
                                                                                                                                                                                                                                                        • API String ID: 3215553584-579935070
                                                                                                                                                                                                                                                        • Opcode ID: 8c3a45f75ca5c0a3459ca2e96ae2fbbf181a3d63a640e770f0a7cf37c7606cec
                                                                                                                                                                                                                                                        • Instruction ID: 53a5e62fd60fce3afd5988f4579ef4c477f8b6f48b12e39e70c624fd91b1f16c
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 8c3a45f75ca5c0a3459ca2e96ae2fbbf181a3d63a640e770f0a7cf37c7606cec
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 9591B132A08646C1EB61AE28DC5077DB6A2AF64F54FC44336EA9D473D6DF3CE4458321
                                                                                                                                                                                                                                                        Function 00007FF70568FBC8 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2506127906.00007FF705671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF705670000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506100994.00007FF705670000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506163767.00007FF70569B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506256106.00007FF7056B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff705670000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                                        • String ID: UTF-16LEUNICODE$UTF-8$ccs
                                                                                                                                                                                                                                                        • API String ID: 3215553584-1196891531
                                                                                                                                                                                                                                                        • Opcode ID: 7089664b0a027e884898b454f5d4d61e653d4f3baae8c024cbe23c99275e4c13
                                                                                                                                                                                                                                                        • Instruction ID: 57b7ba93c11e57519d7cd907c1fd9c7b37e3337652b83290a098ec2fd4495ff8
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 7089664b0a027e884898b454f5d4d61e653d4f3baae8c024cbe23c99275e4c13
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 3281DF72E18243C5F764BF298914279F6A2AF11F48FD59631FB0997286CF2DE9028321
                                                                                                                                                                                                                                                        Function 00007FF70567D648 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 154COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2506127906.00007FF705671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF705670000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506100994.00007FF705670000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506163767.00007FF70569B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506256106.00007FF7056B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff705670000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: CurrentImageNonwritableUnwind__except_validate_context_record
                                                                                                                                                                                                                                                        • String ID: csm
                                                                                                                                                                                                                                                        • API String ID: 2395640692-1018135373
                                                                                                                                                                                                                                                        • Opcode ID: 4bd751ab4a757734da5bac4c310991cbc8ef63d187f18c7a3c34a87046479a0f
                                                                                                                                                                                                                                                        • Instruction ID: e34e562fa51a0ef4af3c1c6ce86a551e4fc2d03fe0ff1a8c759c43a0a4c33b7b
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 4bd751ab4a757734da5bac4c310991cbc8ef63d187f18c7a3c34a87046479a0f
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: F151A032A196068ADB54EB15D844A7CB3A2FF44F98F908531EA4D47788EF7CE841C750
                                                                                                                                                                                                                                                        Function 00007FF70567EED8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2506127906.00007FF705671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF705670000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506100994.00007FF705670000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506163767.00007FF70569B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506256106.00007FF7056B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff705670000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: CallEncodePointerTranslator
                                                                                                                                                                                                                                                        • String ID: MOC$RCC
                                                                                                                                                                                                                                                        • API String ID: 3544855599-2084237596
                                                                                                                                                                                                                                                        • Opcode ID: 1c81a5d02d7979dd4dad50f55436adaf5051385037e661534b2c2f58034018d3
                                                                                                                                                                                                                                                        • Instruction ID: 964a6f8a43817f127eb3c889034a6dfbab4904e3ea6a2744004326a4ab199f55
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 1c81a5d02d7979dd4dad50f55436adaf5051385037e661534b2c2f58034018d3
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 8C618032908B8985DB20EB25E8407AAF7A1FB85F98F444225EB9C07B59CF7CD194CB10
                                                                                                                                                                                                                                                        Function 00007FF70567F288 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2506127906.00007FF705671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF705670000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506100994.00007FF705670000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506163767.00007FF70569B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506256106.00007FF7056B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff705670000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
                                                                                                                                                                                                                                                        • String ID: csm$csm
                                                                                                                                                                                                                                                        • API String ID: 3896166516-3733052814
                                                                                                                                                                                                                                                        • Opcode ID: b828653c103bc27f8420a51a056d9897bfd6e6497fd7c081c32eb92dd3ed2bbb
                                                                                                                                                                                                                                                        • Instruction ID: 19cc2ad3bd3748b5088f2e4f6c48cc56e8831dbe12670ba3f7cae548dd090668
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: b828653c103bc27f8420a51a056d9897bfd6e6497fd7c081c32eb92dd3ed2bbb
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 6951B13260824A86EB70EB21D94466CF7A6EF54F94F944236FA5C43B8ACF3CE450C751
                                                                                                                                                                                                                                                        Function 00007FF705672810 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 65windowCOMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2506127906.00007FF705671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF705670000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506100994.00007FF705670000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506163767.00007FF70569B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506256106.00007FF7056B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff705670000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: Message
                                                                                                                                                                                                                                                        • String ID: ERROR$Error$[PYI-%d:%ls]
                                                                                                                                                                                                                                                        • API String ID: 2030045667-255084403
                                                                                                                                                                                                                                                        • Opcode ID: 035b7a672ed8def45fe49a9c290554376ffedfd07499b26c39d849b73b89d90e
                                                                                                                                                                                                                                                        • Instruction ID: fd3bbc6cd30f2545ec3351f87c9f1f1f2b71fe9ac14e559a999cc68efe1e0cbd
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 035b7a672ed8def45fe49a9c290554376ffedfd07499b26c39d849b73b89d90e
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: BE219F62B08B4192E710EB14F8547AAA3A6EF88F84F800136FA8D53669DF3CD659C750
                                                                                                                                                                                                                                                        Function 00007FF70568C5A0 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2506127906.00007FF705671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF705670000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506100994.00007FF705670000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506163767.00007FF70569B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506256106.00007FF7056B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff705670000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: FileWrite$ConsoleErrorLastOutput
                                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                                        • API String ID: 2718003287-0
                                                                                                                                                                                                                                                        • Opcode ID: 04e310725d937c0b27e7ac1e6c46040fced781be2c4963351fe3137ba04acc33
                                                                                                                                                                                                                                                        • Instruction ID: 8eaf770572a40652cf9f8955c0be55af8a9858eb74c55140e091e5f68bb79359
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 04e310725d937c0b27e7ac1e6c46040fced781be2c4963351fe3137ba04acc33
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 5DD1E272B18A4189FB10DF65D8402BC77A2FB54F98B804275EE5D9BB99DF38D406C720
                                                                                                                                                                                                                                                        Function 00007FF7056720C0 Relevance: 6.1, APIs: 4, Instructions: 52COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2506127906.00007FF705671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF705670000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506100994.00007FF705670000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506163767.00007FF70569B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506256106.00007FF7056B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff705670000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: LongWindow$DialogInvalidateRect
                                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                                        • API String ID: 1956198572-0
                                                                                                                                                                                                                                                        • Opcode ID: 3f66ec3ad31a24d6b03c6ecd933265a99c2c3f38e7b83c206d3886b5f9d1bb92
                                                                                                                                                                                                                                                        • Instruction ID: 7d071e73f99ad39acf4b209842ef0e6a6014b011215799c33cc2dbf2747e77f4
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 3f66ec3ad31a24d6b03c6ecd933265a99c2c3f38e7b83c206d3886b5f9d1bb92
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: CF11A325A1C14642F654E769BD4427E9393FF85F80FC44130FB4907B9ACF2DD4959620
                                                                                                                                                                                                                                                        Function 00007FF705695B1C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2506127906.00007FF705671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF705670000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506100994.00007FF705670000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506163767.00007FF70569B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506256106.00007FF7056B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff705670000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: _get_daylight$_invalid_parameter_noinfo
                                                                                                                                                                                                                                                        • String ID: ?
                                                                                                                                                                                                                                                        • API String ID: 1286766494-1684325040
                                                                                                                                                                                                                                                        • Opcode ID: 21862b7f5a6063227688de7d7fc5fbfc7fa1fb1d7946118fe9e576ba790fa6aa
                                                                                                                                                                                                                                                        • Instruction ID: 4617d25d75e8d16a4a73090e882bc7d27666f353612bc7e255d476ea85c22117
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 21862b7f5a6063227688de7d7fc5fbfc7fa1fb1d7946118fe9e576ba790fa6aa
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 0D415832A0838282FB22A725DC51379E65AEFA1FA4F944275FE5E06AD9DF3CD441C710
                                                                                                                                                                                                                                                        Function 00007FF705689014 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        • _invalid_parameter_noinfo.LIBCMT ref: 00007FF705689046
                                                                                                                                                                                                                                                          • Part of subcall function 00007FF70568A948: RtlFreeHeap.NTDLL(?,?,?,00007FF705692D22,?,?,?,00007FF705692D5F,?,?,00000000,00007FF705693225,?,?,?,00007FF705693157), ref: 00007FF70568A95E
                                                                                                                                                                                                                                                          • Part of subcall function 00007FF70568A948: GetLastError.KERNEL32(?,?,?,00007FF705692D22,?,?,?,00007FF705692D5F,?,?,00000000,00007FF705693225,?,?,?,00007FF705693157), ref: 00007FF70568A968
                                                                                                                                                                                                                                                        • GetModuleFileNameW.KERNEL32(?,?,?,?,?,00007FF70567CBA5), ref: 00007FF705689064
                                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2506127906.00007FF705671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF705670000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506100994.00007FF705670000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506163767.00007FF70569B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506256106.00007FF7056B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff705670000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: ErrorFileFreeHeapLastModuleName_invalid_parameter_noinfo
                                                                                                                                                                                                                                                        • String ID: C:\Users\user\Desktop\wp-s2.exe
                                                                                                                                                                                                                                                        • API String ID: 3580290477-590426878
                                                                                                                                                                                                                                                        • Opcode ID: 136b352ca89953b7aac46d199a587659114d0cf60bae53edf27061cb20026a80
                                                                                                                                                                                                                                                        • Instruction ID: c8be5c4593ced9e41cec7dbad56767cfdced9c48c1f6ba9113e5fa07fa88f750
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 136b352ca89953b7aac46d199a587659114d0cf60bae53edf27061cb20026a80
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 1A415C36A08A12C6EB15AF25DC500BDA7A6EF85FD4B954136FA4E43B85DF3CE481C320
                                                                                                                                                                                                                                                        Function 00007FF70568CC38 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2506127906.00007FF705671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF705670000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506100994.00007FF705670000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506163767.00007FF70569B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506256106.00007FF7056B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff705670000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: ErrorFileLastWrite
                                                                                                                                                                                                                                                        • String ID: U
                                                                                                                                                                                                                                                        • API String ID: 442123175-4171548499
                                                                                                                                                                                                                                                        • Opcode ID: 4f5d94246872f2193e537bc66f33c90add5f7e97f4787e66017fcfb3b1ebd6d4
                                                                                                                                                                                                                                                        • Instruction ID: 055fe6e79717f5468951a12913d0d046066261fa91c5d561dc4daf8fd5691590
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 4f5d94246872f2193e537bc66f33c90add5f7e97f4787e66017fcfb3b1ebd6d4
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: C141B322618A4581EB60EF25E8453B9A7A6FB88F94F804131FE4D87794EF3CD441C760
                                                                                                                                                                                                                                                        Function 00007FF70568F5B8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2506127906.00007FF705671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF705670000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506100994.00007FF705670000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506163767.00007FF70569B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506256106.00007FF7056B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff705670000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: CurrentDirectory
                                                                                                                                                                                                                                                        • String ID: :
                                                                                                                                                                                                                                                        • API String ID: 1611563598-336475711
                                                                                                                                                                                                                                                        • Opcode ID: 9aa1b1c0966d0181e71a7442aa19fd9d8a3a06258be719e39fc35e3b215e25b0
                                                                                                                                                                                                                                                        • Instruction ID: 65a54bce7641e605273b80b3140372cbfc13e7a1061c9ac08ea9be54b7f027d5
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 9aa1b1c0966d0181e71a7442aa19fd9d8a3a06258be719e39fc35e3b215e25b0
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: DB21C362A1824181EB20AB11D84427DE3B7FF88F44FC54235EA4D43694DF7DE9C48B61
                                                                                                                                                                                                                                                        Function 00007FF70567FD48 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2506127906.00007FF705671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF705670000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506100994.00007FF705670000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506163767.00007FF70569B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506256106.00007FF7056B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff705670000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: ExceptionFileHeaderRaise
                                                                                                                                                                                                                                                        • String ID: csm
                                                                                                                                                                                                                                                        • API String ID: 2573137834-1018135373
                                                                                                                                                                                                                                                        • Opcode ID: b596af9f6a60738c50b353da5cbad86497326ffe12a5eabfdc94c01c9dae4a3e
                                                                                                                                                                                                                                                        • Instruction ID: 9b9dd890a3d8d2cbe7959d54de8bb9e4982a47c3f0a381a22bec20019255ae5f
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: b596af9f6a60738c50b353da5cbad86497326ffe12a5eabfdc94c01c9dae4a3e
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 7F111932618B8582EB619F15F840269F7E5FF88F88F984630EA8D07768DF3CD5518B00
                                                                                                                                                                                                                                                        Function 00007FF70569073C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000000.00000002.2506127906.00007FF705671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF705670000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506100994.00007FF705670000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506163767.00007FF70569B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506204468.00007FF7056B2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000000.00000002.2506256106.00007FF7056B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_7ff705670000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: DriveType_invalid_parameter_noinfo
                                                                                                                                                                                                                                                        • String ID: :
                                                                                                                                                                                                                                                        • API String ID: 2595371189-336475711
                                                                                                                                                                                                                                                        • Opcode ID: 68237dfdc7112287ec82a3b365f776b5c9f6f856de5878160eaa1a8f91e0357f
                                                                                                                                                                                                                                                        • Instruction ID: 2468bdcf95c6098567e197be7c41905e86d86fd5f287fde6c908840bfa8c12a9
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 68237dfdc7112287ec82a3b365f776b5c9f6f856de5878160eaa1a8f91e0357f
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 9601846591C20386F720BF60986927EA3A5EF44F68FC00136F54D46691DF2CD504CB34

                                                                                                                                                                                                                                                        Non-executed Functions

                                                                                                                                                                                                                                                        Function 00007FFDFA1DC9AC Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000001.00000002.2487993994.00007FFDF9F11000.00000020.00000001.01000000.0000001C.sdmp, Offset: 00007FFDF9F10000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000001.00000002.2487967329.00007FFDF9F10000.00000002.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000001.00000002.2488274998.00007FFDFA1DE000.00000002.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000001.00000002.2488474616.00007FFDFA32B000.00000008.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000001.00000002.2488512979.00007FFDFA33B000.00000004.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000001.00000002.2488561551.00007FFDFA341000.00000008.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000001.00000002.2488584837.00007FFDFA346000.00000004.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000001.00000002.2488612719.00007FFDFA355000.00000008.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000001.00000002.2488654963.00007FFDFA35C000.00000004.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000001.00000002.2488678161.00007FFDFA35D000.00000008.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000001.00000002.2488736476.00007FFDFA35E000.00000004.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000001.00000002.2488756047.00007FFDFA35F000.00000008.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000001.00000002.2488786410.00007FFDFA378000.00000004.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000001.00000002.2488811491.00007FFDFA387000.00000008.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000001.00000002.2488837134.00007FFDFA397000.00000004.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000001.00000002.2488860995.00007FFDFA398000.00000008.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000001.00000002.2488879444.00007FFDFA399000.00000004.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000001.00000002.2488902204.00007FFDFA39A000.00000008.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000001.00000002.2488924209.00007FFDFA39D000.00000004.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000001.00000002.2488949218.00007FFDFA39F000.00000002.00000001.01000000.0000001C.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_7ffdf9f10000_wp-s2.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
                                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                                        • API String ID: 2933794660-0
                                                                                                                                                                                                                                                        • Opcode ID: 19a014122a8329d598b8a719417dcd6d526a9fad5fd2adc0fdb65de44e15e28a
                                                                                                                                                                                                                                                        • Instruction ID: e6bbb45bb6accc3bc1650c2566a0aef212a578899c35e72bbd0c4d7ef67d7204
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 19a014122a8329d598b8a719417dcd6d526a9fad5fd2adc0fdb65de44e15e28a
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 7D111826F15F018AEB00DBA0E8646B933A4FB59758F440E75EA6D467E8DF78D158C340