Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
1.exe

Overview

General Information

Sample name:1.exe
Analysis ID:1585170
MD5:3689dace869abbbe4e87f57078f6bec9
SHA1:568f5a26f433d55c2628e3e3a5555a9046b19ee3
SHA256:610f9a21f99667ede85d082521e7b8150b158b80bc1d13c4498ac095b2316255
Tags:exemalwaretrojanuser-Joker
Infos:

Detection

Score:96
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
AI detected suspicious sample
Drops password protected ZIP file
Found pyInstaller with non standard icon
Suspicious powershell command line found
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Crypto Currency Wallets
Tries to steal communication platform credentials (via file / registry access)
Uses cmd line tools excessively to alter registry or file data
Binary contains a suspicious time stamp
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Contains capabilities to detect virtual machines
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to query CPU information (cpuid)
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates a window with clipboard capturing capabilities
Detected potential crypto function
Drops PE files
Enables debug privileges
Extensive use of GetProcAddress (often used to hide API calls)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Found evasive API chain checking for process token information
Found potential string decryption / allocating functions
IP address seen in connection with other malware
May check the online IP address of the machine
May sleep (evasive loops) to hinder dynamic analysis
PE file contains executable resources (Code or Archives)
PE file contains sections with non-standard names
PE file does not import any functions
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: PowerShell Get-Clipboard Cmdlet Via CLI
Uses code obfuscation techniques (call, push, ret)
Uses reg.exe to modify the Windows registry
Uses taskkill to terminate processes

Classification

Process Tree

  • System is w10x64
  • 1.exe (PID: 5968 cmdline: "C:\Users\user\Desktop\1.exe" MD5: 3689DACE869ABBBE4E87F57078F6BEC9)
    • 1.exe (PID: 2304 cmdline: "C:\Users\user\Desktop\1.exe" MD5: 3689DACE869ABBBE4E87F57078F6BEC9)
      • cmd.exe (PID: 5916 cmdline: C:\Windows\system32\cmd.exe /c "ver" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 616 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • WMIC.exe (PID: 6028 cmdline: wmic path win32_VideoController get name MD5: C37F2F4F4B3CD128BDABCAEB2266A785)
        • conhost.exe (PID: 5772 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • WMIC.exe (PID: 3424 cmdline: wmic csproduct get uuid MD5: C37F2F4F4B3CD128BDABCAEB2266A785)
        • conhost.exe (PID: 3040 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • cmd.exe (PID: 5876 cmdline: C:\Windows\system32\cmd.exe /c REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2> nul MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 1596 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • reg.exe (PID: 1708 cmdline: REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc MD5: 227F63E1D9008B36BDBCC4B397780BE4)
      • cmd.exe (PID: 3420 cmdline: C:\Windows\system32\cmd.exe /c REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2> nul MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 5388 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • reg.exe (PID: 6516 cmdline: REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName MD5: 227F63E1D9008B36BDBCC4B397780BE4)
      • cmd.exe (PID: 5824 cmdline: C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 1976 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • powershell.exe (PID: 6012 cmdline: powershell Get-Clipboard MD5: 04029E121A0CFA5991749937DD22A1D9)
      • cmd.exe (PID: 1492 cmdline: C:\Windows\system32\cmd.exe /c "tasklist" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 4148 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • tasklist.exe (PID: 6768 cmdline: tasklist MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)
      • cmd.exe (PID: 5588 cmdline: C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 988 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • WMIC.exe (PID: 6120 cmdline: WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName MD5: C37F2F4F4B3CD128BDABCAEB2266A785)
      • cmd.exe (PID: 5876 cmdline: C:\Windows\system32\cmd.exe /c "taskkill /f /im exodus.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 2912 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • taskkill.exe (PID: 5388 cmdline: taskkill /f /im exodus.exe MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)
      • powershell.exe (PID: 6720 cmdline: powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault MD5: 04029E121A0CFA5991749937DD22A1D9)
        • conhost.exe (PID: 1056 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • powershell.exe (PID: 6496 cmdline: powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName MD5: 04029E121A0CFA5991749937DD22A1D9)
        • conhost.exe (PID: 4864 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • WMIC.exe (PID: 2948 cmdline: wmic cpu get name MD5: C37F2F4F4B3CD128BDABCAEB2266A785)
        • conhost.exe (PID: 6088 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • WMIC.exe (PID: 2064 cmdline: wmic path win32_VideoController get name MD5: C37F2F4F4B3CD128BDABCAEB2266A785)
        • conhost.exe (PID: 6116 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • WMIC.exe (PID: 6732 cmdline: wmic computersystem get TotalPhysicalMemory MD5: C37F2F4F4B3CD128BDABCAEB2266A785)
        • conhost.exe (PID: 6768 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • cmd.exe (PID: 5924 cmdline: C:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\WMIC.exe csproduct get uuid" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 6204 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • WMIC.exe (PID: 404 cmdline: C:\Windows\System32\wbem\WMIC.exe csproduct get uuid MD5: C37F2F4F4B3CD128BDABCAEB2266A785)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

System Summary

barindex
Sigma detected: PowerShell Get-Clipboard Cmdlet Via CLI
Source: Process startedAuthor: Nasreddine Bencherchali (Nextron Systems): Data: Command: C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard", CommandLine: C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\1.exe", ParentImage: C:\Users\user\Desktop\1.exe, ParentProcessId: 2304, ParentProcessName: 1.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard", ProcessId: 5824, ProcessName: cmd.exe
Sigma detected: Non Interactive PowerShell Process Spawned
Source: Process startedAuthor: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell Get-Clipboard, CommandLine: powershell Get-Clipboard, CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5824, ParentProcessName: cmd.exe, ProcessCommandLine: powershell Get-Clipboard, ProcessId: 6012, ProcessName: powershell.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Antivirus / Scanner detection for submitted sample
Source: 1.exeAvira: detected
Multi AV Scanner detection for submitted file
Source: 1.exeReversingLabs: Detection: 41%
Source: 1.exeVirustotal: Detection: 51%Perma Link
AI detected suspicious sample
Source: Submited SampleIntegrated Neural Analysis Model: Matched 97.6% probability
Source: 1.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Source: Binary string: api-ms-win-crt-locale-l1-1-0.pdb source: 1.exe, 00000000.00000003.2142968513.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-crt-runtime-l1-1-0.pdb source: 1.exe, 00000000.00000003.2143265512.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-file-l1-2-0.pdb source: 1.exe, 00000000.00000003.2140777254.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-memory-l1-1-0.pdb source: 1.exe, 00000000.00000003.2141418951.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-debug-l1-1-0.pdb source: 1.exe, 00000000.00000003.2140544033.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-sysinfo-l1-1-0.pdb source: 1.exe, 00000000.00000003.2142382964.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-crt-filesystem-l1-1-0.pdb source: 1.exe, 00000000.00000003.2142817399.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-crt-stdio-l1-1-0.pdb source: 1.exe, 00000000.00000003.2143334365.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdbGCTL source: 1.exe, 00000000.00000003.2131826778.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_multiprocessing.pdb source: 1.exe, 00000000.00000003.2139072724.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-heap-l1-1-0.pdb source: 1.exe, 00000000.00000003.2141003458.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdb source: 1.exe, 00000000.00000003.2132886454.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-util-l1-1-0.pdb source: 1.exe, 00000000.00000003.2142525333.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-synch-l1-1-0.pdb source: 1.exe, 00000000.00000003.2142237741.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-crt-environment-l1-1-0.pdb source: 1.exe, 00000000.00000003.2142745850.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-errorhandling-l1-1-0.pdb source: 1.exe, 00000000.00000003.2140622674.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_hashlib.pdb source: 1.exe, 00000000.00000003.2137189149.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-processthreads-l1-1-0.pdb source: 1.exe, 00000000.00000003.2141655577.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-console-l1-1-0.pdb source: 1.exe, 00000000.00000003.2140377919.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-file-l1-1-0.pdb source: 1.exe, 00000000.00000003.2140699760.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_asyncio.pdb source: 1.exe, 00000000.00000003.2132982549.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-crt-convert-l1-1-0.pdb source: 1.exe, 00000000.00000003.2142669958.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_lzma.pdb source: 1.exe, 00000000.00000003.2138600147.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_bz2.pdb source: 1.exe, 00000000.00000003.2134334170.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-profile-l1-1-0.pdb source: 1.exe, 00000000.00000003.2141831695.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_socket.pdb source: 1.exe, 00000000.00000003.2139833055.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdbGCTL source: 1.exe, 00000000.00000003.2132886454.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-crt-time-l1-1-0.pdb source: 1.exe, 00000000.00000003.2143485995.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-handle-l1-1-0.pdb source: 1.exe, 00000000.00000003.2140922599.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\unicodedata.pdb source: 1.exe, 00000000.00000003.2155530941.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-synch-l1-2-0.pdb source: 1.exe, 00000000.00000003.2142313193.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-processenvironment-l1-1-0.pdb source: 1.exe, 00000000.00000003.2141572961.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-datetime-l1-1-0.pdb source: 1.exe, 00000000.00000003.2140462716.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_overlapped.pdb source: 1.exe, 00000000.00000003.2139356733.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-crt-conio-l1-1-0.pdb source: 1.exe, 00000000.00000003.2142599569.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: 1.exe, 00000000.00000003.2131826778.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-311\Release\win32trace.pdb source: 1.exe, 00000000.00000003.2156359102.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-localization-l1-2-0.pdb source: 1.exe, 00000000.00000003.2141336946.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-crt-math-l1-1-0.pdb source: 1.exe, 00000000.00000003.2143041232.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-processthreads-l1-1-1.pdb source: 1.exe, 00000000.00000003.2141736865.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\select.pdb source: 1.exe, 00000000.00000003.2153685705.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-namedpipe-l1-1-0.pdb source: 1.exe, 00000000.00000003.2141498347.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-crt-multibyte-l1-1-0.pdb source: 1.exe, 00000000.00000003.2143117515.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-crt-utility-l1-1-0.pdb source: 1.exe, 00000000.00000003.2143561263.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-rtlsupport-l1-1-0.pdb source: 1.exe, 00000000.00000003.2141929537.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-timezone-l1-1-0.pdb source: 1.exe, 00000000.00000003.2142454218.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-string-l1-1-0.pdb source: 1.exe, 00000000.00000003.2142163746.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-file-l2-1-0.pdb source: 1.exe, 00000000.00000003.2140851936.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_lzma.pdbNN source: 1.exe, 00000000.00000003.2138600147.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-crt-process-l1-1-0.pdb source: 1.exe, 00000000.00000003.2143194031.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-libraryloader-l1-1-0.pdb source: 1.exe, 00000000.00000003.2141252511.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_uuid.pdb source: 1.exe, 00000000.00000003.2140281789.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_queue.pdb source: 1.exe, 00000000.00000003.2139745215.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-interlocked-l1-1-0.pdb source: 1.exe, 00000000.00000003.2141074156.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-interlocked-l1-1-0.dll.0.dr
Source: Binary string: D:\a\1\b\bin\amd64\python3.pdb source: 1.exe, 00000000.00000003.2151337499.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-crt-heap-l1-1-0.pdb source: 1.exe, 00000000.00000003.2142891494.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-crt-string-l1-1-0.pdb source: 1.exe, 00000000.00000003.2143412270.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp
Source: C:\Users\user\Desktop\1.exeCode function: 0_2_00007FF7E93A79B0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,0_2_00007FF7E93A79B0
Source: C:\Users\user\Desktop\1.exeCode function: 0_2_00007FF7E93A85A0 FindFirstFileExW,FindClose,0_2_00007FF7E93A85A0
Source: C:\Users\user\Desktop\1.exeCode function: 0_2_00007FF7E93C0B84 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,0_2_00007FF7E93C0B84
Source: Joe Sandbox ViewIP Address: 208.95.112.1 208.95.112.1
Source: Joe Sandbox ViewIP Address: 144.76.136.153 144.76.136.153
Source: Joe Sandbox ViewIP Address: 144.76.136.153 144.76.136.153
Source: unknownDNS query: name: ip-api.com
Source: unknownDNS query: name: ipinfo.io
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global trafficHTTP traffic detected: GET /json/?fields=hosting,query HTTP/1.1Host: ip-api.comUser-Agent: python-requests/2.32.3Accept-Encoding: gzip, deflateAccept: */*Connection: keep-alive
Source: global trafficDNS traffic detected: DNS query: idefasoft.fr
Source: global trafficDNS traffic detected: DNS query: tiktok.com
Source: global trafficDNS traffic detected: DNS query: ip-api.com
Source: global trafficDNS traffic detected: DNS query: ipinfo.io
Source: global trafficDNS traffic detected: DNS query: api.gofile.io
Source: global trafficDNS traffic detected: DNS query: transfer.sh
Source: 1.exe, 00000002.00000003.2997011920.0000026ABB14E000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2992893692.0000026ABAF88000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2995799183.0000026ABB127000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2993635054.0000026ABAF99000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2352647127.0000026ABAF88000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2353294920.0000026ABB0DE000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2280798075.0000026ABAF88000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2993635054.0000026ABB0DE000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2995270880.0000026ABBA4C000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2280798075.0000026ABB0DE000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2995270880.0000026ABBC23000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3000582627.0000026ABBC53000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2997607005.0000026ABBC52000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2310405179.0000026ABAF88000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2996510516.0000026ABB13F000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3002928468.0000026ABBD35000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2999565146.0000026ABAF9B000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2997370247.0000026ABBADF000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3001866849.0000026ABBD2A000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2997370247.0000026ABBC23000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://blog.cryptographyusering.com/2012/05/how-to-choose-authenticated-encryption.html
Source: 1.exe, 00000000.00000003.2138600147.00000239A9B54000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.co
Source: 1.exe, 00000000.00000003.2138600147.00000239A9B54000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.cog
Source: 1.exe, 00000000.00000003.2136128759.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2138600147.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2137189149.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2140281789.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2148956047.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2139745215.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2151162895.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2134334170.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2139833055.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2155530941.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2148956047.00000239A9B61000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2139072724.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2151966728.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2132982549.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2139356733.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2139967004.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2136291245.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2148956047.00000239A9B5B000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2154615224.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2153685705.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2150719484.00000239A9B54000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: 1.exe, 00000000.00000003.2136128759.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2138600147.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2137189149.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2140281789.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2148956047.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2139745215.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2151162895.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2134334170.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2139833055.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2155530941.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2148956047.00000239A9B61000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2139072724.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2151966728.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2132982549.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2139356733.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2139967004.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2136291245.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2148956047.00000239A9B5B000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2154615224.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2153685705.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2150719484.00000239A9B54000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: 1.exe, 00000000.00000003.2136128759.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2138600147.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2137189149.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2140281789.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2148956047.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2139745215.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2151162895.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2134334170.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2139833055.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2155530941.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2139072724.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2151966728.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2132982549.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2139356733.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2139967004.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2136291245.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2148956047.00000239A9B5B000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2154615224.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2153685705.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2150719484.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2151337499.00000239A9B54000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: 1.exe, 00000000.00000003.2136128759.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2138600147.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2137189149.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2140281789.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2148956047.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2139745215.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2151162895.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2134334170.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2139833055.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2155530941.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2139072724.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2151966728.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2132982549.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2139356733.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2139967004.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2136291245.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2148956047.00000239A9B5B000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2154615224.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2153685705.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2150719484.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2151337499.00000239A9B54000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: 1.exe, 00000002.00000003.2306588393.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2301140771.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2992326469.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3004069377.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2311139842.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2277886088.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2353134905.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/RapidSSLTLSDVRSAMixedSHA2562020CA-1.crt
Source: 1.exe, 00000002.00000003.2997162730.0000026ABB89A000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2992893692.0000026ABAF88000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2179705139.0000026ABA981000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2993635054.0000026ABAF99000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2997294385.0000026ABB8A3000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2352647127.0000026ABAF88000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2280798075.0000026ABAF88000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2992785265.0000026ABA95D000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2994800910.0000026ABAFBD000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3001286090.0000026ABAFD9000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3002970788.0000026ABA9AC000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2182433260.0000026ABA95D000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2180117962.0000026ABA96E000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2310405179.0000026ABAF88000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2994382349.0000026ABAFBB000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2999455715.0000026ABA95D000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3000087971.0000026ABA987000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://code.activestate.com/recipes/577452-a-memoize-decorator-for-instance-methods/
Source: 1.exe, 00000002.00000003.2178691193.0000026ABAF4F000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2176894637.0000026ABAF79000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2352647127.0000026ABAECC000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2353294920.0000026ABAED2000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2176894637.0000026ABAFC9000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2992893692.0000026ABAECE000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2182245662.0000026ABAEB3000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2310405179.0000026ABAED2000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2178404758.0000026ABAF4F000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3002721519.0000026ABAEFA000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2182150064.0000026ABAFD5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2180761502.0000026ABAF40000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2280798075.0000026ABAED2000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2180633947.0000026ABAFDF000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2178370407.0000026ABAFAF000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2180225392.0000026ABAFD5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://code.activestate.com/recipes/577916/
Source: 1.exe, 00000002.00000003.2301140771.0000026ABBDFA000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2277886088.0000026ABBDFA000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2352647127.0000026ABAECC000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2353294920.0000026ABAED2000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2298450794.0000026ABBDFA000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2311139842.0000026ABBDFA000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2999964452.0000026ABBDFA000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2992893692.0000026ABAECE000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2992326469.0000026ABBDFA000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2310405179.0000026ABAED2000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2353134905.0000026ABBDFA000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2280798075.0000026ABAED2000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2306588393.0000026ABBDFA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.certigna.fr/certignarootca.crl01
Source: 1.exe, 00000002.00000003.2999720061.0000026ABA8AC000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2992893692.0000026ABAF88000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2993635054.0000026ABAF99000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2352647127.0000026ABAF88000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2280798075.0000026ABAF88000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2994800910.0000026ABAFBD000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2310405179.0000026ABAF88000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2994382349.0000026ABAFBB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: 1.exe, 00000002.00000003.2306588393.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2996807987.0000026ABBC89000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2301140771.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2992326469.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3004069377.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2311139842.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2277886088.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2995270880.0000026ABBC89000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2353134905.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.comodoca.com/COMODOCertificationAuthority.crl
Source: 1.exe, 00000002.00000003.2301140771.0000026ABBDFA000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2277886088.0000026ABBDFA000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2352647127.0000026ABAECC000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2353294920.0000026ABAED2000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2298450794.0000026ABBDFA000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2311139842.0000026ABBDFA000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2999964452.0000026ABBDFA000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2992893692.0000026ABAECE000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2992326469.0000026ABBDFA000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2310405179.0000026ABAED2000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2353134905.0000026ABBDFA000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2280798075.0000026ABAED2000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2306588393.0000026ABBDFA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.dhimyotis.com/certignarootca.crl
Source: powershell.exe, 0000001F.00000002.2416517613.00000220986C6000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000001F.00000002.2418599178.00000220988E4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.m
Source: 1.exe, 00000002.00000003.2306588393.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2301140771.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2992326469.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3004069377.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2311139842.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2277886088.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2353134905.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.securetrust.com/SGCA.crl
Source: 1.exe, 00000002.00000003.2301140771.0000026ABBDFA000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2277886088.0000026ABBDFA000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2298450794.0000026ABBDFA000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2311139842.0000026ABBDFA000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2999964452.0000026ABBDFA000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2992326469.0000026ABBDFA000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2353134905.0000026ABBDFA000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2306588393.0000026ABBDFA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.securetrust.com/SGCA.crl0
Source: 1.exe, 00000002.00000003.2306588393.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2301140771.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2992326469.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3004069377.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2311139842.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2277886088.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2353134905.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.securetrust.com/SGCA.crlC
Source: 1.exe, 00000002.00000003.2306588393.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2301140771.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2992326469.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3004069377.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2311139842.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2277886088.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2353134905.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.securetrust.com/STCA.crl
Source: 1.exe, 00000002.00000003.3002799381.0000026ABB96F000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2995270880.0000026ABB96E000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3003667534.0000026ABB9BB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.securetrust.com/STCA.crl0
Source: 1.exe, 00000002.00000003.2306588393.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2301140771.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2992326469.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3004069377.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2311139842.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2277886088.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2353134905.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.securetrust.com/STCA.crlKG
Source: 1.exe, 00000002.00000003.2306588393.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2301140771.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2992326469.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3004069377.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2311139842.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2277886088.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2353134905.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl
Source: 1.exe, 00000002.00000003.2992893692.0000026ABAF88000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2993635054.0000026ABAF99000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2352647127.0000026ABAF88000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2280798075.0000026ABAF88000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2994800910.0000026ABAFBD000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2310405179.0000026ABAF88000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2994382349.0000026ABAFBB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl0
Source: 1.exe, 00000002.00000003.2306588393.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2301140771.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2992326469.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3004069377.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2311139842.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2277886088.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2353134905.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.xrampsecurity.com/XGCA.crlC
Source: 1.exe, 00000000.00000003.2136128759.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2138600147.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2137189149.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2140281789.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2148956047.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2139745215.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2151162895.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2134334170.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2139833055.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2155530941.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2148956047.00000239A9B61000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2139072724.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2151966728.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2132982549.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2139356733.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2139967004.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2136291245.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2148956047.00000239A9B5B000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2154615224.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2153685705.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2150719484.00000239A9B54000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: 1.exe, 00000000.00000003.2136128759.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2138600147.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2137189149.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2140281789.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2148956047.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2139745215.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2151162895.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2134334170.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2139833055.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2155530941.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2148956047.00000239A9B61000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2139072724.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2151966728.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2132982549.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2139356733.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2139967004.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2136291245.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2148956047.00000239A9B5B000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2154615224.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2153685705.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2150719484.00000239A9B54000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: 1.exe, 00000000.00000003.2136128759.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2138600147.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2137189149.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2140281789.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2148956047.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2139745215.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2151162895.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2134334170.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2139833055.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2155530941.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2139072724.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2151966728.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2132982549.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2139356733.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2139967004.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2136291245.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2148956047.00000239A9B5B000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2154615224.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2153685705.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2150719484.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2151337499.00000239A9B54000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: 1.exe, 00000000.00000003.2140131037.00000239A9B54000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: 1.exe, 00000002.00000003.2306588393.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2301140771.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2992326469.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3004069377.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2311139842.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2277886088.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2353134905.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/RapidSSLTLSDVRSAMixedSHA2562020CA-1.crl
Source: 1.exe, 00000000.00000003.2136128759.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2138600147.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2137189149.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2140281789.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2148956047.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2139745215.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2151162895.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2134334170.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2139833055.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2155530941.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2148956047.00000239A9B61000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2139072724.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2151966728.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2132982549.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2139356733.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2139967004.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2136291245.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2148956047.00000239A9B5B000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2154615224.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2153685705.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2150719484.00000239A9B54000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: 1.exe, 00000002.00000003.2306588393.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2301140771.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2992326469.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3004069377.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2311139842.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2277886088.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2353134905.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/RapidSSLTLSDVRSAMixedSHA2562020CA-1.crl
Source: 1.exe, 00000002.00000003.2997011920.0000026ABB14E000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2995799183.0000026ABB127000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2353294920.0000026ABB0DE000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2993635054.0000026ABB0DE000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2995270880.0000026ABBA4C000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2280798075.0000026ABB0DE000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2995270880.0000026ABBC23000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2996510516.0000026ABB13F000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2997370247.0000026ABBADF000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2997370247.0000026ABBC23000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://csrc.nist.gov/groups/ST/toolkit/BCM/documents/proposedmodes/eax/eax-spec.pdf
Source: 1.exe, 00000002.00000003.2995270880.0000026ABBA4C000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3002928468.0000026ABBD35000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2997370247.0000026ABBADF000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3001866849.0000026ABBD2A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://csrc.nist.gov/publications/nistpubs/800-38C/SP800-38C.pdf
Source: 1.exe, 00000002.00000003.2992893692.0000026ABAF88000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2993635054.0000026ABAF99000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2352647127.0000026ABAF88000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2280798075.0000026ABAF88000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2995270880.0000026ABBC23000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3000582627.0000026ABBC53000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2997607005.0000026ABBC52000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2310405179.0000026ABAF88000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2999565146.0000026ABAF9B000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2997370247.0000026ABBC23000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://csrc.nist.gov/publications/nistpubs/800-38D/SP-800-38D.pdf
Source: 1.exe, 00000002.00000003.2301140771.0000026ABBDFA000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2277886088.0000026ABBDFA000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2298450794.0000026ABBDFA000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2311139842.0000026ABBDFA000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2999964452.0000026ABBDFA000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2995270880.0000026ABBA4C000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2992326469.0000026ABBDFA000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3000187409.0000026ABBA67000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3002928468.0000026ABBD35000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2353134905.0000026ABBDFA000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2997370247.0000026ABBADF000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3001866849.0000026ABBD2A000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2998754025.0000026ABBA4C000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2306588393.0000026ABBDFA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://csrc.nist.gov/publications/nistpubs/800-38a/sp800-38a.pdf
Source: 1.exe, 00000002.00000003.2178691193.0000026ABAF4F000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2178404758.0000026ABAF4F000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2180761502.0000026ABAF40000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://docs.python.org/library/itertools.html#recipes
Source: 1.exe, 00000002.00000003.2995270880.0000026ABB96E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://docs.python.org/library/unittest.html
Source: 1.exe, 00000002.00000003.2178691193.0000026ABAF4F000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2178404758.0000026ABAF4F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://github.com/ActiveState/appdirs
Source: 1.exe, 00000002.00000003.2995270880.0000026ABBA14000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2998754025.0000026ABBA14000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://google.com/
Source: 1.exe, 00000002.00000003.2996807987.0000026ABBC89000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2995270880.0000026ABBC23000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3000582627.0000026ABBC53000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2997607005.0000026ABBC52000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3003232850.0000026ABBC8C000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2995270880.0000026ABBC89000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2997370247.0000026ABBC23000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://hg.python.org/cpython/file/603b4d593758/Lib/socket.py#l535
Source: powershell.exe, 0000001D.00000002.2339161609.000001B211E8C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001D.00000002.2322558013.000001B2037D8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001D.00000002.2339161609.000001B211FC3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001F.00000002.2409548445.000002209017C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001F.00000002.2409548445.00000220902B3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001F.00000002.2361908430.0000022081A99000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://nuget.org/NuGet.exe
Source: 1.exe, 00000002.00000003.2999720061.0000026ABA8AC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.accv.es
Source: 1.exe, 00000002.00000003.2306588393.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2301140771.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2992326469.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3004069377.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2311139842.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2277886088.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2353134905.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.accv.es0
Source: 1.exe, 00000002.00000003.2306588393.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2301140771.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2992326469.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3004069377.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2311139842.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2277886088.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2353134905.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com
Source: 1.exe, 00000000.00000003.2136128759.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2138600147.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2137189149.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2140281789.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2148956047.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2139745215.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2151162895.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2134334170.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2139833055.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2155530941.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2148956047.00000239A9B61000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2139072724.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2151966728.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2132982549.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2139356733.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2139967004.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2136291245.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2148956047.00000239A9B5B000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2154615224.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2153685705.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2150719484.00000239A9B54000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0
Source: 1.exe, 00000000.00000003.2136128759.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2138600147.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2137189149.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2140281789.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2148956047.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2139745215.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2151162895.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2134334170.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2139833055.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2155530941.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2139072724.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2151966728.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2132982549.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2139356733.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2139967004.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2136291245.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2148956047.00000239A9B5B000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2154615224.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2153685705.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2150719484.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2151337499.00000239A9B54000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0A
Source: 1.exe, 00000000.00000003.2136128759.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2138600147.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2137189149.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2140281789.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2148956047.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2139745215.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2151162895.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2134334170.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2139833055.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2155530941.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2148956047.00000239A9B61000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2139072724.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2151966728.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2132982549.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2139356733.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2139967004.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2136291245.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2148956047.00000239A9B5B000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2154615224.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2153685705.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2150719484.00000239A9B54000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0C
Source: 1.exe, 00000000.00000003.2136128759.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2138600147.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2137189149.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2140281789.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2148956047.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2139745215.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2151162895.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2134334170.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2139833055.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2155530941.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2139072724.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2151966728.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2132982549.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2139356733.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2139967004.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2136291245.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2148956047.00000239A9B5B000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2154615224.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2153685705.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2150719484.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2151337499.00000239A9B54000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0X
Source: powershell.exe, 0000001F.00000002.2361908430.0000022081980000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: 1.exe, 00000002.00000003.2996807987.0000026ABBC89000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2995270880.0000026ABBC89000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://repository.swisssign.com/
Source: 1.exe, 00000002.00000003.2995270880.0000026ABBA4C000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2997370247.0000026ABBADF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://repository.swisssign.com/er
Source: 1.exe, 00000002.00000003.2996807987.0000026ABBC89000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2995270880.0000026ABBC89000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://repository.swisssign.com/p
Source: 1.exe, 00000002.00000003.2306588393.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2301140771.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2992326469.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3004069377.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2311139842.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2277886088.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2353134905.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://repository.swisssign.com/uw
Source: powershell.exe, 0000001D.00000002.2322558013.000001B201E11000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001F.00000002.2361908430.0000022080101000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: 1.exe, 00000002.00000003.2995270880.0000026ABBA14000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2995270880.0000026ABBA4C000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2995270880.0000026ABBC23000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2998754025.0000026ABBA14000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2997370247.0000026ABBADF000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2997370247.0000026ABBC23000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://tools.ietf.org/html/rfc4880
Source: 1.exe, 00000002.00000003.3002928468.0000026ABBD35000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3001866849.0000026ABBD2A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://tools.ietf.org/html/rfc5297
Source: 1.exe, 00000002.00000003.2992893692.0000026ABAF88000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2993635054.0000026ABAF99000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2352647127.0000026ABAF88000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2280798075.0000026ABAF88000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2994800910.0000026ABAFBD000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2301140771.0000026ABBD66000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2306588393.0000026ABBD65000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2310405179.0000026ABAF88000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2994382349.0000026ABAFBB000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2311139842.0000026ABBD66000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2298450794.0000026ABBD66000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2994346572.0000026ABBD63000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2277886088.0000026ABBD63000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2353134905.0000026ABBD63000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://tools.ietf.org/html/rfc5869
Source: 1.exe, 00000002.00000003.2996807987.0000026ABBC89000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2995270880.0000026ABBA4C000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2997370247.0000026ABBADF000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2995270880.0000026ABBC89000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://web.cs.ucdavis.edu/~rogaway/ocb/license.htm
Source: 1.exe, 00000002.00000003.2999720061.0000026ABA8AC000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2306588393.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2301140771.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2992326469.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3004069377.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2311139842.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2277886088.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2353134905.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1.crt0
Source: 1.exe, 00000002.00000003.2353134905.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl
Source: 1.exe, 00000002.00000003.2306588393.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2301140771.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2992326469.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3004069377.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2311139842.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2277886088.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2353134905.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl0
Source: 1.exe, 00000002.00000003.2301140771.0000026ABBDFA000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2277886088.0000026ABBDFA000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2298450794.0000026ABBDFA000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2311139842.0000026ABBDFA000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2999964452.0000026ABBDFA000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2992326469.0000026ABBDFA000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2353134905.0000026ABBDFA000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2306588393.0000026ABBDFA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.accv.es/legislacion_c.htm
Source: 1.exe, 00000002.00000003.2306588393.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2301140771.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2992326469.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3004069377.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2311139842.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2277886088.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2353134905.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.accv.es/legislacion_c.htm0U
Source: 1.exe, 00000002.00000003.2301140771.0000026ABBDFA000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2306588393.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2301140771.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2277886088.0000026ABBDFA000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2992326469.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2298450794.0000026ABBDFA000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2311139842.0000026ABBDFA000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2999964452.0000026ABBDFA000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2992326469.0000026ABBDFA000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3004069377.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2311139842.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2277886088.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2353134905.0000026ABBDFA000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2353134905.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2306588393.0000026ABBDFA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.accv.es00
Source: powershell.exe, 0000001D.00000002.2322558013.000001B2032B7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001F.00000002.2361908430.00000220815A1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: powershell.exe, 0000001F.00000002.2361908430.0000022081980000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: 1.exe, 00000002.00000003.2301140771.0000026ABBDFA000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2277886088.0000026ABBDFA000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2298450794.0000026ABBDFA000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2311139842.0000026ABBDFA000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2999964452.0000026ABBDFA000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2992326469.0000026ABBDFA000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2353134905.0000026ABBDFA000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2306588393.0000026ABBDFA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.cert.fnmt.es/dpcs/
Source: 1.exe, 00000002.00000003.2995270880.0000026ABBA14000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2998754025.0000026ABBA14000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.cert.fnmt.es/dpcs/U
Source: 1.exe, 00000002.00000003.2179228653.0000026ABAEFB000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2178404758.0000026ABAEFB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.cl.cam.ac.uk/~mgk25/iso-time.html
Source: 1.exe, 00000002.00000003.2995270880.0000026ABBA4C000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3002928468.0000026ABBD35000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2997370247.0000026ABBADF000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3001866849.0000026ABBD2A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.cs.ucdavis.edu/~rogaway/papers/keywrap.pdf
Source: 1.exe, 00000002.00000003.2306588393.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2301140771.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2992326469.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3004069377.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2311139842.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2277886088.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2353134905.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.digicert.com/CPS
Source: 1.exe, 00000000.00000003.2136128759.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2138600147.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2137189149.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2140281789.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2148956047.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2139745215.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2151162895.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2134334170.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2139833055.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2155530941.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2148956047.00000239A9B61000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2139072724.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2151966728.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2132982549.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2139356733.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2139967004.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2136291245.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2148956047.00000239A9B5B000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2154615224.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2153685705.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2150719484.00000239A9B54000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.digicert.com/CPS0
Source: 1.exe, 00000002.00000003.2301140771.0000026ABBDFA000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2277886088.0000026ABBDFA000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2298450794.0000026ABBDFA000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2311139842.0000026ABBDFA000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2999964452.0000026ABBDFA000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2992326469.0000026ABBDFA000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2353134905.0000026ABBDFA000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2306588393.0000026ABBDFA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.firmaprofesional.com/cps0
Source: 1.exe, 00000002.00000003.2995739666.0000026ABB8D0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6
Source: powershell.exe, 0000001D.00000002.2322328763.000001B200545000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.microsoft.co-
Source: 1.exe, 00000002.00000003.2994108677.0000026ABBF6B000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2993523199.0000026ABBF61000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.microsoftOWNLO~1.TXTy./
Source: 1.exe, 00000002.00000003.2352534061.0000026ABBF6B000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2352031794.0000026ABBF5E000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2310267438.0000026ABBF6C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.microsoftom/pkiops/Docs/Repository./
Source: 1.exe, 00000002.00000003.2179228653.0000026ABAEFB000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2180761502.0000026ABAEFB000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2178404758.0000026ABAEFB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.phys.uu.nl/~vgent/calendar/isocalendar.htm
Source: 1.exe, 00000002.00000003.2306588393.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2301140771.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2992326469.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3004069377.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2311139842.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2277886088.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2353134905.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.quovadisglobal.com/cps
Source: 1.exe, 00000002.00000003.2995270880.0000026ABBA4C000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3000187409.0000026ABBA67000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2998754025.0000026ABBA4C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.quovadisglobal.com/cps0
Source: 1.exe, 00000002.00000003.2996807987.0000026ABBC89000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2995270880.0000026ABBA4C000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2997370247.0000026ABBADF000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2995270880.0000026ABBC89000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.rfc-editor.org/info/rfc7253
Source: 1.exe, 00000002.00000003.2995270880.0000026ABBA4C000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3002928468.0000026ABBD35000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2997370247.0000026ABBADF000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3001866849.0000026ABBD2A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.tarsnap.com/scrypt/scrypt-slides.pdf
Source: 1.exe, 00000002.00000003.2997011920.0000026ABB14E000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2995799183.0000026ABB127000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2353294920.0000026ABB0DE000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2993635054.0000026ABB0DE000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2280798075.0000026ABB0DE000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2996510516.0000026ABB13F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://wwwsearch.sf.net/):
Source: 1.exe, 00000002.00000003.2291765845.0000026ABD135000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: powershell.exe, 0000001D.00000002.2322558013.000001B201E11000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001F.00000002.2361908430.0000022080101000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://aka.ms/pscore68
Source: 1.exe, 00000000.00000003.2153965322.00000239A9B54000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://blog.jaraco.com/skeleton
Source: 1.exe, 00000002.00000003.2992893692.0000026ABAF88000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2993635054.0000026ABAF99000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2352647127.0000026ABAF88000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2280798075.0000026ABAF88000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2994800910.0000026ABAFBD000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2301140771.0000026ABBD66000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2306588393.0000026ABBD65000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2310405179.0000026ABAF88000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2994382349.0000026ABAFBB000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2311139842.0000026ABBD66000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2298450794.0000026ABBD66000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2994346572.0000026ABBD63000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2277886088.0000026ABBD63000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2353134905.0000026ABBD63000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://boxmatrix.info/wiki/Property:arping
Source: 1.exe, 00000002.00000003.2310172216.0000026ABCF4F000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2994251647.0000026ABCF59000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2277385060.0000026ABCF48000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2306171318.0000026ABCF4F000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2351954090.0000026ABCF48000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2992481017.0000026ABCF50000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://brew.sh
Source: 1.exe, 00000002.00000003.2352031794.0000026ABBF5E000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2993523199.0000026ABBF61000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://bugzilla.mo
Source: 1.exe, 00000002.00000003.2291765845.0000026ABD135000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: 1.exe, 00000002.00000003.2291765845.0000026ABD135000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: 1.exe, 00000002.00000003.2291765845.0000026ABD135000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: 1.exe, 00000000.00000003.2153965322.00000239A9B54000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://codecov.io/gh/pypa/setuptools
Source: powershell.exe, 0000001F.00000002.2361908430.0000022081A99000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/
Source: powershell.exe, 0000001F.00000002.2361908430.0000022081A99000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 0000001F.00000002.2361908430.0000022081A99000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/License
Source: 1.exe, 00000000.00000003.2145498424.00000239A9B57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://cryptography.io
Source: 1.exe, 00000000.00000003.2145498424.00000239A9B57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://cryptography.io/
Source: 1.exe, 00000000.00000003.2145498424.00000239A9B57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://cryptography.io/en/latest/changelog/
Source: 1.exe, 00000002.00000003.2351404547.0000026ABD00A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://cryptography.io/en/latest/hazmat/
Source: 1.exe, 00000000.00000003.2145498424.00000239A9B57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://cryptography.io/en/latest/installation/
Source: 1.exe, 00000000.00000003.2145498424.00000239A9B57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://cryptography.io/en/latest/security/
Source: 1.exe, 00000000.00000003.2153965322.00000239A9B54000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://discord.com/channels/803025117553754132/815945031150993468
Source: 1.exe, 00000002.00000003.2995270880.0000026ABBA4C000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3000187409.0000026ABBA67000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2998754025.0000026ABBA4C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://discordbackuper.uk.to/webhooks/hyzen_webhook/
Source: 1.exe, 00000002.00000003.2995270880.0000026ABBA4C000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3000187409.0000026ABBA67000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2998754025.0000026ABBA4C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://discordverify.tech/webhooks/hyzen_dsc/
Source: 1.exe, 00000002.00000003.2998754025.0000026ABBA4C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://discordverify.tech/webhooks/hyzen_exod/
Source: 1.exe, 00000002.00000003.3000243404.0000026ABA7E5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3002000425.0000026ABA7EB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3.11/library/binascii.html#binascii.a2b_base64
Source: 1.exe, 00000002.00000003.2176303617.0000026ABA9DE000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2179705139.0000026ABA981000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2992785265.0000026ABA95D000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2994217265.0000026ABAA0E000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2175307708.0000026ABA9DE000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2182433260.0000026ABA95D000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2180117962.0000026ABA96E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/multiprocessing.html
Source: 1.exe, 00000002.00000003.2353294920.0000026ABB0DE000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2993635054.0000026ABB0DE000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2181839807.0000026ABB0DE000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2280798075.0000026ABB0DE000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2185527521.0000026ABB1B2000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2996474924.0000026ABB100000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2996307404.0000026ABB0DE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/pprint.html
Source: 1.exe, 00000002.00000003.2353294920.0000026ABB0DE000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2993635054.0000026ABB0DE000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2181839807.0000026ABB0DE000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2280798075.0000026ABB0DE000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2185527521.0000026ABB1B2000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2996474924.0000026ABB100000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2996307404.0000026ABB0DE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/pprint.html#pprint.pprint
Source: 1.exe, 00000002.00000003.2180036404.0000026ABB055000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2310405179.0000026ABAF88000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2994382349.0000026ABAFBB000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2182150064.0000026ABAFD5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2996307404.0000026ABB0DE000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3003947861.0000026ABAEB0000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2280798075.0000026ABAED2000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3003851740.0000026ABAFDF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/re.html
Source: 1.exe, 00000002.00000003.2180036404.0000026ABB0C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2180036404.0000026ABB055000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/re.html#re.sub
Source: 1.exe, 00000002.00000003.2291765845.0000026ABD135000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/ac/?q=
Source: 1.exe, 00000002.00000003.2291765845.0000026ABD135000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: 1.exe, 00000002.00000003.2291765845.0000026ABD135000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: 1.exe, 00000002.00000003.2352647127.0000026ABAECC000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2353294920.0000026ABAED2000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2992893692.0000026ABAECE000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2310405179.0000026ABAED2000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2280798075.0000026ABAED2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/Ousret/charset_normalizer
Source: powershell.exe, 0000001F.00000002.2361908430.0000022081980000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/Pester/Pester
Source: 1.exe, 00000002.00000003.2992893692.0000026ABAF88000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2993635054.0000026ABAF99000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2352647127.0000026ABAF88000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2280798075.0000026ABAF88000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2994800910.0000026ABAFBD000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2301140771.0000026ABBD66000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2306588393.0000026ABBD65000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2310405179.0000026ABAF88000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2994382349.0000026ABAFBB000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2311139842.0000026ABBD66000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2298450794.0000026ABBD66000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2994346572.0000026ABBD63000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2277886088.0000026ABBD63000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2353134905.0000026ABBD63000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/ThomasHabets/arping
Source: 1.exe, 00000002.00000003.2158391223.0000026ABA733000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy
Source: 1.exe, 00000000.00000003.2156102244.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2131046109.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2156359102.00000239A9B61000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2153299506.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2156359102.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2156219072.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2156481090.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2153550121.00000239A9B54000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/mhammond/pywin32
Source: 1.exe, 00000000.00000003.2153965322.00000239A9B54000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/psf/black
Source: 1.exe, 00000000.00000003.2145498424.00000239A9B57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/pyca/cryptography
Source: 1.exe, 00000000.00000003.2145498424.00000239A9B57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/pyca/cryptography/
Source: 1.exe, 00000000.00000003.2145498424.00000239A9B57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/pyca/cryptography/actions?query=workflow%3ACI
Source: 1.exe, 00000000.00000003.2145498424.00000239A9B57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/pyca/cryptography/issues
Source: 1.exe, 00000000.00000003.2145498424.00000239A9B57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/pyca/cryptography/workflows/CI/badge.svg?branch=main
Source: 1.exe, 00000000.00000003.2153965322.00000239A9B54000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/pypa/.github/blob/main/CODE_OF_CONDUCT.md
Source: 1.exe, 00000002.00000003.2182245662.0000026ABAEB3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/pypa/packaging
Source: 1.exe, 00000000.00000003.2153965322.00000239A9B54000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/pypa/setuptools
Source: 1.exe, 00000000.00000003.2153965322.00000239A9B54000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/pypa/setuptools/actions?query=workflow%3A%22tests%22
Source: 1.exe, 00000000.00000003.2153965322.00000239A9B54000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/pypa/setuptools/discussions
Source: 1.exe, 00000000.00000003.2153965322.00000239A9B54000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/pypa/setuptools/issues
Source: 1.exe, 00000000.00000003.2153965322.00000239A9B54000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/pypa/setuptools/workflows/tests/badge.svg
Source: 1.exe, 00000002.00000003.2999455715.0000026ABA95D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/pyparsing/pyparsing/wiki
Source: 1.exe, 00000002.00000003.2158391223.0000026ABA733000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688
Source: 1.exe, 00000002.00000003.2158391223.0000026ABA733000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py
Source: 1.exe, 00000002.00000003.2158391223.0000026ABA733000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader
Source: 1.exe, 00000002.00000003.2175307708.0000026ABA92F000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2173498918.0000026ABA942000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2999720061.0000026ABA8FB000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2181034075.0000026ABA917000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3001503647.0000026ABA938000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3001217368.0000026ABA919000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2172016941.0000026ABA92F000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2179579918.0000026ABA910000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2171915048.0000026ABA9D0000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2172422142.0000026ABA935000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2997745773.0000026ABA8FA000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2174618831.0000026ABA942000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2176443939.0000026ABA92F000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2172929866.0000026ABA940000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python/cpython/issues/86361.
Source: 1.exe, 00000002.00000003.2158391223.0000026ABA733000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#
Source: 1.exe, 00000002.00000003.2995270880.0000026ABBA4C000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3000187409.0000026ABBA67000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2998754025.0000026ABBA4C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/urllib3/urllib3/issues/2513#issuecomment-1152559900.
Source: 1.exe, 00000002.00000003.2352647127.0000026ABAECC000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2353294920.0000026ABAED2000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2995270880.0000026ABBA4C000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2992893692.0000026ABAECE000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2995270880.0000026ABBC23000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3000582627.0000026ABBC53000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2997607005.0000026ABBC52000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2310405179.0000026ABAED2000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2280798075.0000026ABAED2000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2997370247.0000026ABBADF000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3000818569.0000026ABA748000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3003885082.0000026ABA7B5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3001462320.0000026ABA7A9000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2997370247.0000026ABBC23000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://google.com/
Source: 1.exe, 00000002.00000003.2995270880.0000026ABBA4C000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2995270880.0000026ABBC23000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3000582627.0000026ABBC53000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2997607005.0000026ABBC52000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2997370247.0000026ABBADF000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2997370247.0000026ABBC23000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://google.com/mail
Source: 1.exe, 00000002.00000003.2995270880.0000026ABB96E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://google.com/mail/
Source: 1.exe, 00000002.00000003.2352647127.0000026ABAECC000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2353294920.0000026ABAED2000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2992893692.0000026ABAECE000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2310405179.0000026ABAED2000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2280798075.0000026ABAED2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://html.spec.whatwg.org/multipage/
Source: 1.exe, 00000002.00000003.3001462320.0000026ABA7A9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://httpbin.org/
Source: 1.exe, 00000002.00000003.2306588393.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2301140771.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2992326469.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2995270880.0000026ABBA4C000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2995270880.0000026ABBC23000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3000582627.0000026ABBC53000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3000187409.0000026ABBA67000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2997607005.0000026ABBC52000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3004069377.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2311139842.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2277886088.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2997370247.0000026ABBADF000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2997370247.0000026ABBC23000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2353134905.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2998754025.0000026ABBA4C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://httpbin.org/get
Source: 1.exe, 00000002.00000003.2992893692.0000026ABAF88000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2993635054.0000026ABAF99000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2352647127.0000026ABAF88000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2280798075.0000026ABAF88000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2994800910.0000026ABAFBD000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2310405179.0000026ABAF88000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2994382349.0000026ABAFBB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://httpbin.org/post
Source: 1.exe, 00000002.00000003.2995270880.0000026ABBA4C000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3000187409.0000026ABBA67000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2998754025.0000026ABBA4C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://idefasoft.fr/pastes/KBEUSDINd5Da/raw/
Source: 1.exe, 00000002.00000003.2995270880.0000026ABBA4C000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3000187409.0000026ABBA67000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2998754025.0000026ABBA4C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://idefasoft.fr/pastes/TFI8bM6C3BzB/raw/
Source: 1.exe, 00000000.00000003.2153965322.00000239A9B54000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://img.shields.io/badge/code%20style-black-000000.svg
Source: 1.exe, 00000000.00000003.2153965322.00000239A9B54000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://img.shields.io/badge/skeleton-2022-informational
Source: 1.exe, 00000000.00000003.2153965322.00000239A9B54000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://img.shields.io/codecov/c/github/pypa/setuptools/master.svg?logo=codecov&logoColor=white
Source: 1.exe, 00000000.00000003.2153965322.00000239A9B54000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://img.shields.io/discord/803025117553754132
Source: 1.exe, 00000000.00000003.2153965322.00000239A9B54000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://img.shields.io/pypi/pyversions/setuptools.svg
Source: 1.exe, 00000000.00000003.2145498424.00000239A9B57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://img.shields.io/pypi/v/cryptography.svg
Source: 1.exe, 00000000.00000003.2153965322.00000239A9B54000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://img.shields.io/pypi/v/setuptools.svg
Source: 1.exe, 00000000.00000003.2153965322.00000239A9B54000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://img.shields.io/readthedocs/setuptools/latest.svg
Source: 1.exe, 00000002.00000003.2997885206.0000026ABB883000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2185527521.0000026ABB20C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://json.org
Source: 1.exe, 00000002.00000003.2350512173.0000026ABD0CA000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2992079577.0000026ABD0CD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.microsoftonline.com
Source: 1.exe, 00000000.00000003.2145498424.00000239A9B57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://mail.python.org/mailman/listinfo/cryptography-dev
Source: powershell.exe, 0000001D.00000002.2339161609.000001B211E8C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001D.00000002.2322558013.000001B2037D8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001D.00000002.2339161609.000001B211FC3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001F.00000002.2409548445.000002209017C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001F.00000002.2409548445.00000220902B3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001F.00000002.2361908430.0000022081A99000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://nuget.org/nuget.exe
Source: 1.exe, 00000002.00000003.2997011920.0000026ABB14E000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2995799183.0000026ABB127000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2353294920.0000026ABB0DE000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2993635054.0000026ABB0DE000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2280798075.0000026ABB0DE000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2996510516.0000026ABB13F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-108r1.pdf
Source: powershell.exe, 0000001D.00000002.2322558013.000001B2032B7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001F.00000002.2361908430.00000220815A1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://oneget.org
Source: powershell.exe, 0000001D.00000002.2322558013.000001B2032B7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001F.00000002.2361908430.00000220815A1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://oneget.orgX
Source: 1.exe, 00000002.00000003.2992893692.0000026ABAF88000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2993635054.0000026ABAF99000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2352647127.0000026ABAF88000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2280798075.0000026ABAF88000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2994800910.0000026ABAFBD000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2301140771.0000026ABBD66000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2306588393.0000026ABBD65000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2310405179.0000026ABAF88000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2994382349.0000026ABAFBB000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2311139842.0000026ABBD66000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2298450794.0000026ABBD66000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2994346572.0000026ABBD63000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2277886088.0000026ABBD63000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2353134905.0000026ABBD63000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://packages.debian.org/sid/iputils-arping
Source: 1.exe, 00000002.00000003.2997885206.0000026ABB883000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://packaging.python.org/en/latest/specifications/declaring-project-metadata/
Source: 1.exe, 00000000.00000003.2153965322.00000239A9B54000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://packaging.python.org/installing/
Source: 1.exe, 00000002.00000003.2169109816.0000026ABA8B4000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2170125233.0000026ABA8AA000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2170531315.0000026ABA8AA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://peps.python.org/pep-0205/
Source: 1.exe, 00000000.00000003.2145498424.00000239A9B57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://pypi.org/project/cryptography/
Source: 1.exe, 00000000.00000003.2153965322.00000239A9B54000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://pypi.org/project/setuptools
Source: 1.exe, 00000000.00000003.2153965322.00000239A9B54000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://raw.githubusercontent.com/pypa/setuptools/main/docs/images/banner-640x320.svg
Source: 1.exe, 00000000.00000003.2145498424.00000239A9B57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://readthedocs.org/projects/cryptography/badge/?version=latest
Source: 1.exe, 00000002.00000003.2992893692.0000026ABAF88000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2993635054.0000026ABAF99000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2352647127.0000026ABAF88000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2280798075.0000026ABAF88000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2994800910.0000026ABAFBD000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2310405179.0000026ABAF88000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2994382349.0000026ABAFBB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://requests.readthedocs.io
Source: 1.exe, 00000000.00000003.2153965322.00000239A9B54000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://setuptools.pypa.io
Source: 1.exe, 00000000.00000003.2153965322.00000239A9B54000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://setuptools.pypa.io/
Source: 1.exe, 00000002.00000003.3000414610.0000026ABA878000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2176303617.0000026ABA98F000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2176102647.0000026ABAF2B000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2176102647.0000026ABAEDC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://setuptools.pypa.io/en/latest/pkg_resources.html#basic-resource-access
Source: 1.exe, 00000000.00000003.2153965322.00000239A9B54000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://setuptools.pypa.io/en/stable/history.html
Source: 1.exe, 00000002.00000003.2992893692.0000026ABAF88000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2352647127.0000026ABAECC000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2353294920.0000026ABAED2000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2993635054.0000026ABAF99000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2352647127.0000026ABAF88000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2353294920.0000026ABB0DE000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2280798075.0000026ABAF88000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2993635054.0000026ABB0DE000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2992893692.0000026ABAECE000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2180036404.0000026ABB0C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2280798075.0000026ABB0DE000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2994800910.0000026ABAFBD000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3001286090.0000026ABAFD9000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2182245662.0000026ABAEB3000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2310405179.0000026ABAED2000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2180036404.0000026ABB055000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2310405179.0000026ABAF88000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2994382349.0000026ABAFBB000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2182150064.0000026ABAFD5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2996307404.0000026ABB0DE000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3003947861.0000026ABAEB0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://stackoverflow.com/questions/267399/how-do-you-match-only-valid-roman-numerals-with-a-regular
Source: 1.exe, 00000002.00000003.2306171318.0000026ABCF4F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://support.mozilla.org
Source: 1.exe, 00000002.00000003.2304772061.0000026ABD0DC000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2293244673.0000026ABD0DC000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2299714488.0000026ABD305000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2293063439.0000026ABBF6B000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2308455792.0000026ABD305000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: 1.exe, 00000002.00000003.2994316363.0000026ABD095000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2305993678.0000026ABD08D000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2995270880.0000026ABBA4C000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2294939972.0000026ABD091000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2310315272.0000026ABD090000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3000187409.0000026ABBA67000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2352420223.0000026ABD091000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2309982952.0000026ABD08D000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2306468763.0000026ABD090000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2998754025.0000026ABBA4C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://support.mozilla.org/products/firefox
Source: 1.exe, 00000002.00000003.2304772061.0000026ABD0DC000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2293244673.0000026ABD0DC000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2299714488.0000026ABD305000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2293063439.0000026ABBF6B000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2308455792.0000026ABD305000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt
Source: 1.exe, 00000000.00000003.2153965322.00000239A9B54000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tidelift.com/badges/github/pypa/setuptools?style=flat
Source: 1.exe, 00000000.00000003.2153965322.00000239A9B54000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tidelift.com/security
Source: 1.exe, 00000000.00000003.2153965322.00000239A9B54000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tidelift.com/subscription/pkg/pypi-setuptools?utm_source=pypi-setuptools&utm_medium=readme
Source: 1.exe, 00000000.00000003.2153965322.00000239A9B54000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tidelift.com/subscription/pkg/pypi-setuptools?utm_source=pypi-setuptools&utm_medium=referral
Source: 1.exe, 00000002.00000003.2995270880.0000026ABBA4C000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2998754025.0000026ABBA4C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tools.ietf.org/html/rfc2388#section-4.4
Source: 1.exe, 00000002.00000003.2995270880.0000026ABBA4C000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3002928468.0000026ABBD35000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2997370247.0000026ABBADF000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3001866849.0000026ABBD2A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tools.ietf.org/html/rfc3610
Source: 1.exe, 00000002.00000003.2995270880.0000026ABBA4C000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3002928468.0000026ABBD35000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2997370247.0000026ABBADF000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3001866849.0000026ABBD2A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tools.ietf.org/html/rfc5297
Source: 1.exe, 00000002.00000003.2352647127.0000026ABAECC000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2353294920.0000026ABAED2000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2992893692.0000026ABAECE000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2310405179.0000026ABAED2000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2280798075.0000026ABAED2000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3000818569.0000026ABA748000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3003885082.0000026ABA7B5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3001462320.0000026ABA7A9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://twitter.com/
Source: 1.exe, 00000002.00000003.3003096126.0000026ABA778000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3000818569.0000026ABA748000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://wiki.debian.org/XDGBaseDirectorySpecification#state
Source: 1.exe, 00000000.00000003.2145969486.00000239A9B54000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.apache.org/licenses/
Source: 1.exe, 00000000.00000003.2145969486.00000239A9B62000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2145969486.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2146073212.00000239A9B62000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.apache.org/licenses/LICENSE-2.0
Source: 1.exe, 00000002.00000003.2291765845.0000026ABD135000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.ecosia.org/newtab/
Source: 1.exe, 00000002.00000003.2291765845.0000026ABD135000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: 1.exe, 00000002.00000003.2352647127.0000026ABAECC000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2353294920.0000026ABAED2000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2992893692.0000026ABAECE000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2310405179.0000026ABAED2000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3002928468.0000026ABBD35000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2280798075.0000026ABAED2000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3001866849.0000026ABBD2A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.ietf.org/rfc/rfc2898.txt
Source: 1.exe, 00000002.00000003.2306292367.0000026ABBF6C000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2994108677.0000026ABBF6B000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2352534061.0000026ABBF6B000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2301140771.0000026ABBD66000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2306588393.0000026ABBD65000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2311139842.0000026ABBD66000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2298450794.0000026ABBD66000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2352031794.0000026ABBF5E000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2994346572.0000026ABBD63000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2310267438.0000026ABBF6C000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2993523199.0000026ABBF61000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2277886088.0000026ABBD63000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2353134905.0000026ABBD63000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2293063439.0000026ABBF6B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.manpagez.com/man/8/networksetup/
Source: 1.exe, 00000002.00000003.2305537618.0000026ABD144000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2308882505.0000026ABD144000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org
Source: 1.exe, 00000002.00000003.2306171318.0000026ABCF4F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org#
Source: 1.exe, 00000002.00000003.2350771281.0000026ABD0B7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2293244673.0000026ABD0B7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2305723936.0000026ABD0B1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2305723936.0000026ABD0B7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2350771281.0000026ABD0AA000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2293244673.0000026ABD0B2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/about/
Source: 1.exe, 00000002.00000003.2304772061.0000026ABD0DC000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2293244673.0000026ABD0DC000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2299714488.0000026ABD305000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2293063439.0000026ABBF6B000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2308455792.0000026ABD305000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.bwSC1pmG_zle
Source: 1.exe, 00000002.00000003.2304772061.0000026ABD0DC000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2293244673.0000026ABD0DC000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2299714488.0000026ABD305000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2293063439.0000026ABBF6B000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2308455792.0000026ABD305000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.hjKdHaZH-dbQ
Source: 1.exe, 00000002.00000003.2304772061.0000026ABD0DC000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2293244673.0000026ABD0DC000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2299714488.0000026ABD305000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2293063439.0000026ABBF6B000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2308455792.0000026ABD305000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2293244673.0000026ABD0B2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: 1.exe, 00000000.00000003.2150719484.00000239A9B54000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.openssl.org/H
Source: 1.exe, 00000002.00000003.2994075080.0000026ABCFB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2351404547.0000026ABD00A000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2350870022.0000026ABCFAA000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2352493026.0000026ABCFB1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.openssl.org/docs/manmaster/man3/X509_VERIFY_PARAM_set_flags.html
Source: 1.exe, 00000002.00000003.2306588393.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2301140771.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2992326469.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2994075080.0000026ABCFB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2351404547.0000026ABD00A000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3004069377.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2311139842.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2277886088.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2350870022.0000026ABCFAA000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2352493026.0000026ABCFB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2353134905.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.openssl.org/docs/manmaster/man5/
Source: 1.exe, 00000002.00000003.2992893692.0000026ABAF88000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2993635054.0000026ABAF99000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2352647127.0000026ABAF88000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2280798075.0000026ABAF88000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2994800910.0000026ABAFBD000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2310405179.0000026ABAF88000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2994382349.0000026ABAFBB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.python.org
Source: 1.exe, 00000002.00000003.2995270880.0000026ABBA4C000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3000187409.0000026ABBA67000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2998754025.0000026ABBA4C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.rfc-editor.org/rfc/rfc8259#section-8.1
Source: 1.exe, 00000002.00000003.2301140771.0000026ABBDFA000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2277886088.0000026ABBDFA000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2298450794.0000026ABBDFA000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2311139842.0000026ABBDFA000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2999964452.0000026ABBDFA000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2992326469.0000026ABBDFA000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2353134905.0000026ABBDFA000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2306588393.0000026ABBDFA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://wwww.certigna.fr/autorites/
Source: 1.exe, 00000002.00000003.2352647127.0000026ABAECC000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2353294920.0000026ABAED2000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2992893692.0000026ABAECE000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2310405179.0000026ABAED2000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2280798075.0000026ABAED2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://wwww.certigna.fr/autorites/0m
Source: 1.exe, 00000002.00000003.2995270880.0000026ABBA4C000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2995270880.0000026ABBC23000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3000582627.0000026ABBC53000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2997607005.0000026ABBC52000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2997370247.0000026ABBADF000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2997370247.0000026ABBC23000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://yahoo.com/
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49722
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49886
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49761
Source: unknownNetwork traffic detected: HTTP traffic on port 49761 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49749 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49722 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49938 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49938
Source: unknownNetwork traffic detected: HTTP traffic on port 49943 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49749
Source: unknownNetwork traffic detected: HTTP traffic on port 49886 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49943
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow created: window name: CLIPBRDWNDCLASS

System Summary

barindex
Drops password protected ZIP file
Source: AWGADYhKXN.zip.2.drZip Entry: encrypted
Source: AWGADYhKXN.zip.2.drZip Entry: encrypted
Source: AWGADYhKXN.zip.2.drZip Entry: encrypted
Source: AWGADYhKXN.zip.2.drZip Entry: encrypted
Source: AWGADYhKXN.zip.2.drZip Entry: encrypted
Source: AWGADYhKXN.zip.2.drZip Entry: encrypted
Source: AWGADYhKXN.zip.2.drZip Entry: encrypted
Source: AWGADYhKXN.zip.2.drZip Entry: encrypted
Source: AWGADYhKXN.zip.2.drZip Entry: encrypted
Source: AWGADYhKXN.zip.2.drZip Entry: encrypted
Source: AWGADYhKXN.zip.2.drZip Entry: encrypted
Source: AWGADYhKXN.zip.2.drZip Entry: encrypted
Source: C:\Users\user\Desktop\1.exeCode function: 0_2_00007FF7E93C5C740_2_00007FF7E93C5C74
Source: C:\Users\user\Desktop\1.exeCode function: 0_2_00007FF7E93BFBD80_2_00007FF7E93BFBD8
Source: C:\Users\user\Desktop\1.exeCode function: 0_2_00007FF7E93C4F100_2_00007FF7E93C4F10
Source: C:\Users\user\Desktop\1.exeCode function: 0_2_00007FF7E93A10000_2_00007FF7E93A1000
Source: C:\Users\user\Desktop\1.exeCode function: 0_2_00007FF7E93B0A600_2_00007FF7E93B0A60
Source: C:\Users\user\Desktop\1.exeCode function: 0_2_00007FF7E93B12800_2_00007FF7E93B1280
Source: C:\Users\user\Desktop\1.exeCode function: 0_2_00007FF7E93C8A380_2_00007FF7E93C8A38
Source: C:\Users\user\Desktop\1.exeCode function: 0_2_00007FF7E93B7AAC0_2_00007FF7E93B7AAC
Source: C:\Users\user\Desktop\1.exeCode function: 0_2_00007FF7E93C518C0_2_00007FF7E93C518C
Source: C:\Users\user\Desktop\1.exeCode function: 0_2_00007FF7E93BD2000_2_00007FF7E93BD200
Source: C:\Users\user\Desktop\1.exeCode function: 0_2_00007FF7E93B91B00_2_00007FF7E93B91B0
Source: C:\Users\user\Desktop\1.exeCode function: 0_2_00007FF7E93B0C640_2_00007FF7E93B0C64
Source: C:\Users\user\Desktop\1.exeCode function: 0_2_00007FF7E93B14840_2_00007FF7E93B1484
Source: C:\Users\user\Desktop\1.exeCode function: 0_2_00007FF7E93B2CC40_2_00007FF7E93B2CC4
Source: C:\Users\user\Desktop\1.exeCode function: 0_2_00007FF7E93C0B840_2_00007FF7E93C0B84
Source: C:\Users\user\Desktop\1.exeCode function: 0_2_00007FF7E93A8B200_2_00007FF7E93A8B20
Source: C:\Users\user\Desktop\1.exeCode function: 0_2_00007FF7E93B73F40_2_00007FF7E93B73F4
Source: C:\Users\user\Desktop\1.exeCode function: 0_2_00007FF7E93C33BC0_2_00007FF7E93C33BC
Source: C:\Users\user\Desktop\1.exeCode function: 0_2_00007FF7E93B0E700_2_00007FF7E93B0E70
Source: C:\Users\user\Desktop\1.exeCode function: 0_2_00007FF7E93BCD6C0_2_00007FF7E93BCD6C
Source: C:\Users\user\Desktop\1.exeCode function: 0_2_00007FF7E93A95FB0_2_00007FF7E93A95FB
Source: C:\Users\user\Desktop\1.exeCode function: 0_2_00007FF7E93B10740_2_00007FF7E93B1074
Source: C:\Users\user\Desktop\1.exeCode function: 0_2_00007FF7E93BD8800_2_00007FF7E93BD880
Source: C:\Users\user\Desktop\1.exeCode function: 0_2_00007FF7E93B50400_2_00007FF7E93B5040
Source: C:\Users\user\Desktop\1.exeCode function: 0_2_00007FF7E93B28C00_2_00007FF7E93B28C0
Source: C:\Users\user\Desktop\1.exeCode function: 0_2_00007FF7E93C2F200_2_00007FF7E93C2F20
Source: C:\Users\user\Desktop\1.exeCode function: 0_2_00007FF7E93BFBD80_2_00007FF7E93BFBD8
Source: C:\Users\user\Desktop\1.exeCode function: 0_2_00007FF7E93B1F300_2_00007FF7E93B1F30
Source: C:\Users\user\Desktop\1.exeCode function: 0_2_00007FF7E93C57280_2_00007FF7E93C5728
Source: C:\Users\user\Desktop\1.exeCode function: 0_2_00007FF7E93A979B0_2_00007FF7E93A979B
Source: C:\Users\user\Desktop\1.exeCode function: 0_2_00007FF7E93A9FCD0_2_00007FF7E93A9FCD
Source: C:\Users\user\Desktop\1.exeCode function: String function: 00007FF7E93A25F0 appears 50 times
Source: unicodedata.pyd.0.drStatic PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: _overlapped.pyd.0.drStatic PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: api-ms-win-core-processenvironment-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-interlocked-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-util-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-console-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-crt-process-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-synch-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-timezone-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-file-l2-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-debug-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-string-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-profile-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-localization-l1-2-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-datetime-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-crt-math-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-crt-time-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-crt-locale-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-namedpipe-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-file-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-file-l1-2-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-sysinfo-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-libraryloader-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: python3.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-heap-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-crt-environment-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-crt-stdio-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-processthreads-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-errorhandling-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-handle-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-synch-l1-2-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-processthreads-l1-1-1.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-crt-utility-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-crt-filesystem-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-crt-multibyte-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-rtlsupport-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-crt-conio-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-crt-heap-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-crt-convert-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-crt-runtime-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-crt-string-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-memory-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: 1.exe, 00000000.00000003.2136128759.00000239A9B54000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_ctypes.pyd. vs 1.exe
Source: 1.exe, 00000000.00000003.2138600147.00000239A9B54000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_lzma.pyd. vs 1.exe
Source: 1.exe, 00000000.00000003.2140544033.00000239A9B54000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs 1.exe
Source: 1.exe, 00000000.00000003.2141336946.00000239A9B54000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs 1.exe
Source: 1.exe, 00000000.00000003.2142454218.00000239A9B54000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs 1.exe
Source: 1.exe, 00000000.00000003.2140622674.00000239A9B54000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs 1.exe
Source: 1.exe, 00000000.00000003.2140699760.00000239A9B54000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs 1.exe
Source: 1.exe, 00000000.00000003.2143194031.00000239A9B54000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs 1.exe
Source: 1.exe, 00000000.00000003.2156102244.00000239A9B54000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamewin32api.pyd0 vs 1.exe
Source: 1.exe, 00000000.00000003.2140922599.00000239A9B54000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs 1.exe
Source: 1.exe, 00000000.00000003.2137189149.00000239A9B54000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_hashlib.pyd. vs 1.exe
Source: 1.exe, 00000000.00000003.2141929537.00000239A9B54000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs 1.exe
Source: 1.exe, 00000000.00000003.2132886454.00000239A9B54000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamevcruntime140_1.dllT vs 1.exe
Source: 1.exe, 00000000.00000003.2142891494.00000239A9B54000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs 1.exe
Source: 1.exe, 00000000.00000003.2140281789.00000239A9B54000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_uuid.pyd. vs 1.exe
Source: 1.exe, 00000000.00000003.2141498347.00000239A9B54000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs 1.exe
Source: 1.exe, 00000000.00000003.2139745215.00000239A9B54000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_queue.pyd. vs 1.exe
Source: 1.exe, 00000000.00000003.2142968513.00000239A9B54000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs 1.exe
Source: 1.exe, 00000000.00000003.2143412270.00000239A9B54000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs 1.exe
Source: 1.exe, 00000000.00000003.2140462716.00000239A9B54000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs 1.exe
Source: 1.exe, 00000000.00000003.2143265512.00000239A9B54000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs 1.exe
Source: 1.exe, 00000000.00000003.2141736865.00000239A9B54000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs 1.exe
Source: 1.exe, 00000000.00000003.2151162895.00000239A9B54000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamepyexpat.pyd. vs 1.exe
Source: 1.exe, 00000000.00000003.2134334170.00000239A9B54000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_bz2.pyd. vs 1.exe
Source: 1.exe, 00000000.00000003.2141655577.00000239A9B54000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs 1.exe
Source: 1.exe, 00000000.00000003.2143485995.00000239A9B54000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs 1.exe
Source: 1.exe, 00000000.00000003.2131826778.00000239A9B54000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamevcruntime140.dllT vs 1.exe
Source: 1.exe, 00000000.00000003.2139833055.00000239A9B54000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_socket.pyd. vs 1.exe
Source: 1.exe, 00000000.00000003.2140851936.00000239A9B54000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs 1.exe
Source: 1.exe, 00000000.00000003.2142669958.00000239A9B54000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs 1.exe
Source: 1.exe, 00000000.00000003.2141252511.00000239A9B54000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs 1.exe
Source: 1.exe, 00000000.00000003.2143117515.00000239A9B54000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs 1.exe
Source: 1.exe, 00000000.00000003.2155530941.00000239A9B54000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameunicodedata.pyd. vs 1.exe
Source: 1.exe, 00000000.00000003.2139072724.00000239A9B54000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_multiprocessing.pyd. vs 1.exe
Source: 1.exe, 00000000.00000003.2131046109.00000239A9B54000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamewin32ui.pyd0 vs 1.exe
Source: 1.exe, 00000000.00000003.2141572961.00000239A9B54000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs 1.exe
Source: 1.exe, 00000000.00000003.2132982549.00000239A9B54000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_asyncio.pyd. vs 1.exe
Source: 1.exe, 00000000.00000003.2139356733.00000239A9B54000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_overlapped.pyd. vs 1.exe
Source: 1.exe, 00000000.00000003.2139967004.00000239A9B54000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_sqlite3.pyd. vs 1.exe
Source: 1.exe, 00000000.00000003.2156359102.00000239A9B61000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamewin32trace.pyd0 vs 1.exe
Source: 1.exe, 00000000.00000003.2142817399.00000239A9B54000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs 1.exe
Source: 1.exe, 00000000.00000003.2136291245.00000239A9B54000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_decimal.pyd. vs 1.exe
Source: 1.exe, 00000000.00000003.2153299506.00000239A9B54000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamepythoncom311.dll0 vs 1.exe
Source: 1.exe, 00000000.00000003.2143041232.00000239A9B54000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs 1.exe
Source: 1.exe, 00000000.00000003.2143334365.00000239A9B54000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs 1.exe
Source: 1.exe, 00000000.00000003.2154615224.00000239A9B54000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamesqlite3.dll0 vs 1.exe
Source: 1.exe, 00000000.00000003.2142313193.00000239A9B54000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs 1.exe
Source: 1.exe, 00000000.00000003.2142745850.00000239A9B54000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs 1.exe
Source: 1.exe, 00000000.00000003.2156359102.00000239A9B54000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamewin32trace.pyd0 vs 1.exe
Source: 1.exe, 00000000.00000003.2142525333.00000239A9B54000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs 1.exe
Source: 1.exe, 00000000.00000003.2143561263.00000239A9B54000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs 1.exe
Source: 1.exe, 00000000.00000003.2153685705.00000239A9B54000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameselect.pyd. vs 1.exe
Source: 1.exe, 00000000.00000003.2142237741.00000239A9B54000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs 1.exe
Source: 1.exe, 00000000.00000003.2156219072.00000239A9B54000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamewin32crypt.pyd0 vs 1.exe
Source: 1.exe, 00000000.00000003.2142599569.00000239A9B54000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs 1.exe
Source: 1.exe, 00000000.00000003.2150719484.00000239A9B54000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamelibsslH vs 1.exe
Source: 1.exe, 00000000.00000003.2151337499.00000239A9B54000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamepython3.dll. vs 1.exe
Source: 1.exe, 00000000.00000003.2141074156.00000239A9B54000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs 1.exe
Source: 1.exe, 00000000.00000003.2140131037.00000239A9B54000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_ssl.pyd. vs 1.exe
Source: 1.exe, 00000000.00000003.2142382964.00000239A9B54000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs 1.exe
Source: 1.exe, 00000000.00000003.2140777254.00000239A9B54000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs 1.exe
Source: 1.exe, 00000000.00000003.2141831695.00000239A9B54000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs 1.exe
Source: 1.exe, 00000000.00000003.2155141100.00000239A9B54000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameucrtbase.dllj% vs 1.exe
Source: 1.exe, 00000000.00000003.2141418951.00000239A9B54000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs 1.exe
Source: 1.exe, 00000000.00000003.2141003458.00000239A9B54000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs 1.exe
Source: 1.exe, 00000000.00000003.2140377919.00000239A9B54000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs 1.exe
Source: 1.exe, 00000000.00000003.2156481090.00000239A9B54000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameshell.pyd0 vs 1.exe
Source: 1.exe, 00000000.00000003.2153550121.00000239A9B54000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamepywintypes311.dll0 vs 1.exe
Source: 1.exe, 00000000.00000003.2142163746.00000239A9B54000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs 1.exe
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\reg.exe REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc
Source: classification engineClassification label: mal96.spyw.evad.winEXE@61/210@6/6
Source: C:\Users\user\Desktop\1.exeCode function: 0_2_00007FF7E93A29E0 GetLastError,FormatMessageW,MessageBoxW,0_2_00007FF7E93A29E0
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:988:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMutant created: NULL
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1056:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3040:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6116:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5772:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1976:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4864:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6768:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:616:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6088:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4148:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6204:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5388:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1596:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2912:120:WilError_03
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59682Jump to behavior
Source: 1.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "exodus.exe")
Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\System32\taskkill.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "exodus.exe")
Source: C:\Windows\System32\wbem\WMIC.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Name FROM WIN32_PROCESSOR
Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Users\user\Desktop\1.exeKey opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Source: 1.exe, 00000002.00000003.2309982952.0000026ABD082000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2305723936.0000026ABD0AB000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: 1.exeReversingLabs: Detection: 41%
Source: 1.exeVirustotal: Detection: 51%
Source: C:\Users\user\Desktop\1.exeFile read: C:\Users\user\Desktop\1.exeJump to behavior
Source: unknownProcess created: C:\Users\user\Desktop\1.exe "C:\Users\user\Desktop\1.exe"
Source: C:\Users\user\Desktop\1.exeProcess created: C:\Users\user\Desktop\1.exe "C:\Users\user\Desktop\1.exe"
Source: C:\Users\user\Desktop\1.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "ver"
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\1.exeProcess created: C:\Windows\System32\wbem\WMIC.exe wmic path win32_VideoController get name
Source: C:\Windows\System32\wbem\WMIC.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\1.exeProcess created: C:\Windows\System32\wbem\WMIC.exe wmic csproduct get uuid
Source: C:\Windows\System32\wbem\WMIC.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\1.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2> nul
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\reg.exe REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc
Source: C:\Users\user\Desktop\1.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2> nul
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\reg.exe REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName
Source: C:\Users\user\Desktop\1.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
Source: C:\Users\user\Desktop\1.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist"
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\1.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\tasklist.exe tasklist
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-Clipboard
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wbem\WMIC.exe WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\taskkill.exe taskkill /f /im exodus.exe
Source: C:\Users\user\Desktop\1.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\1.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\1.exeProcess created: C:\Windows\System32\wbem\WMIC.exe wmic cpu get name
Source: C:\Windows\System32\wbem\WMIC.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\1.exeProcess created: C:\Windows\System32\wbem\WMIC.exe wmic path win32_VideoController get name
Source: C:\Windows\System32\wbem\WMIC.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\1.exeProcess created: C:\Windows\System32\wbem\WMIC.exe wmic computersystem get TotalPhysicalMemory
Source: C:\Windows\System32\wbem\WMIC.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\1.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\WMIC.exe csproduct get uuid"
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wbem\WMIC.exe C:\Windows\System32\wbem\WMIC.exe csproduct get uuid
Source: C:\Users\user\Desktop\1.exeProcess created: C:\Users\user\Desktop\1.exe "C:\Users\user\Desktop\1.exe"Jump to behavior
Source: C:\Users\user\Desktop\1.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "ver"Jump to behavior
Source: C:\Users\user\Desktop\1.exeProcess created: C:\Windows\System32\wbem\WMIC.exe wmic path win32_VideoController get nameJump to behavior
Source: C:\Users\user\Desktop\1.exeProcess created: C:\Windows\System32\wbem\WMIC.exe wmic csproduct get uuidJump to behavior
Source: C:\Users\user\Desktop\1.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2> nulJump to behavior
Source: C:\Users\user\Desktop\1.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2> nulJump to behavior
Source: C:\Users\user\Desktop\1.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"Jump to behavior
Source: C:\Users\user\Desktop\1.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist"Jump to behavior
Source: C:\Users\user\Desktop\1.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"Jump to behavior
Source: C:\Users\user\Desktop\1.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2> nulJump to behavior
Source: C:\Users\user\Desktop\1.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefaultJump to behavior
Source: C:\Users\user\Desktop\1.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductNameJump to behavior
Source: C:\Users\user\Desktop\1.exeProcess created: C:\Windows\System32\wbem\WMIC.exe wmic cpu get nameJump to behavior
Source: C:\Users\user\Desktop\1.exeProcess created: C:\Windows\System32\wbem\WMIC.exe wmic path win32_VideoController get nameJump to behavior
Source: C:\Users\user\Desktop\1.exeProcess created: C:\Windows\System32\wbem\WMIC.exe wmic computersystem get TotalPhysicalMemoryJump to behavior
Source: C:\Users\user\Desktop\1.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\WMIC.exe csproduct get uuid"Jump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\reg.exe REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDescJump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\reg.exe REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderNameJump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ClipboardJump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\tasklist.exe tasklistJump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wbem\WMIC.exe WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayNameJump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\taskkill.exe taskkill /f /im exodus.exe
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wbem\WMIC.exe C:\Windows\System32\wbem\WMIC.exe csproduct get uuid
Source: C:\Users\user\Desktop\1.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\Desktop\1.exeSection loaded: version.dllJump to behavior
Source: C:\Users\user\Desktop\1.exeSection loaded: vcruntime140.dllJump to behavior
Source: C:\Users\user\Desktop\1.exeSection loaded: libffi-8.dllJump to behavior
Source: C:\Users\user\Desktop\1.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Users\user\Desktop\1.exeSection loaded: vcruntime140_1.dllJump to behavior
Source: C:\Users\user\Desktop\1.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\Desktop\1.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\Desktop\1.exeSection loaded: urlmon.dllJump to behavior
Source: C:\Users\user\Desktop\1.exeSection loaded: iertutil.dllJump to behavior
Source: C:\Users\user\Desktop\1.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Users\user\Desktop\1.exeSection loaded: netutils.dllJump to behavior
Source: C:\Users\user\Desktop\1.exeSection loaded: secur32.dllJump to behavior
Source: C:\Users\user\Desktop\1.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Users\user\Desktop\1.exeSection loaded: libcrypto-3.dllJump to behavior
Source: C:\Users\user\Desktop\1.exeSection loaded: libssl-3.dllJump to behavior
Source: C:\Users\user\Desktop\1.exeSection loaded: libcrypto-3.dllJump to behavior
Source: C:\Users\user\Desktop\1.exeSection loaded: mswsock.dllJump to behavior
Source: C:\Users\user\Desktop\1.exeSection loaded: powrprof.dllJump to behavior
Source: C:\Users\user\Desktop\1.exeSection loaded: pdh.dllJump to behavior
Source: C:\Users\user\Desktop\1.exeSection loaded: umpdc.dllJump to behavior
Source: C:\Users\user\Desktop\1.exeSection loaded: wtsapi32.dllJump to behavior
Source: C:\Users\user\Desktop\1.exeSection loaded: sqlite3.dllJump to behavior
Source: C:\Users\user\Desktop\1.exeSection loaded: dnsapi.dllJump to behavior
Source: C:\Users\user\Desktop\1.exeSection loaded: rasadhlp.dllJump to behavior
Source: C:\Users\user\Desktop\1.exeSection loaded: fwpuclnt.dllJump to behavior
Source: C:\Users\user\Desktop\1.exeSection loaded: wsock32.dllJump to behavior
Source: C:\Users\user\Desktop\1.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Users\user\Desktop\1.exeSection loaded: dpapi.dllJump to behavior
Source: C:\Users\user\Desktop\1.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: framedynos.dllJump to behavior
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: wbemcomn.dllJump to behavior
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: msxml6.dllJump to behavior
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: urlmon.dllJump to behavior
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: iertutil.dllJump to behavior
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: netutils.dllJump to behavior
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: vcruntime140.dllJump to behavior
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: vcruntime140_1.dllJump to behavior
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: amsi.dllJump to behavior
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: userenv.dllJump to behavior
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: profapi.dllJump to behavior
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: vbscript.dllJump to behavior
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: sxs.dllJump to behavior
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: framedynos.dllJump to behavior
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: wbemcomn.dllJump to behavior
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: msxml6.dllJump to behavior
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: urlmon.dllJump to behavior
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: iertutil.dllJump to behavior
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: netutils.dllJump to behavior
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: vcruntime140.dllJump to behavior
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: vcruntime140_1.dllJump to behavior
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: amsi.dllJump to behavior
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: userenv.dllJump to behavior
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: profapi.dllJump to behavior
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: vbscript.dllJump to behavior
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: sxs.dllJump to behavior
Source: C:\Windows\System32\tasklist.exeSection loaded: version.dllJump to behavior
Source: C:\Windows\System32\tasklist.exeSection loaded: mpr.dllJump to behavior
Source: C:\Windows\System32\tasklist.exeSection loaded: framedynos.dllJump to behavior
Source: C:\Windows\System32\tasklist.exeSection loaded: dbghelp.dllJump to behavior
Source: C:\Windows\System32\tasklist.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Windows\System32\tasklist.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Windows\System32\tasklist.exeSection loaded: netutils.dllJump to behavior
Source: C:\Windows\System32\tasklist.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Windows\System32\tasklist.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\System32\tasklist.exeSection loaded: wbemcomn.dllJump to behavior
Source: C:\Windows\System32\tasklist.exeSection loaded: winsta.dllJump to behavior
Source: C:\Windows\System32\tasklist.exeSection loaded: amsi.dllJump to behavior
Source: C:\Windows\System32\tasklist.exeSection loaded: userenv.dllJump to behavior
Source: C:\Windows\System32\tasklist.exeSection loaded: profapi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: edputil.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: profapi.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: vbscript.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: sxs.dll
Source: C:\Windows\System32\taskkill.exeSection loaded: version.dll
Source: C:\Windows\System32\taskkill.exeSection loaded: mpr.dll
Source: C:\Windows\System32\taskkill.exeSection loaded: framedynos.dll
Source: C:\Windows\System32\taskkill.exeSection loaded: dbghelp.dll
Source: C:\Windows\System32\taskkill.exeSection loaded: sspicli.dll
Source: C:\Windows\System32\taskkill.exeSection loaded: srvcli.dll
Source: C:\Windows\System32\taskkill.exeSection loaded: netutils.dll
Source: C:\Windows\System32\taskkill.exeSection loaded: sspicli.dll
Source: C:\Windows\System32\taskkill.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\System32\taskkill.exeSection loaded: wbemcomn.dll
Source: C:\Windows\System32\taskkill.exeSection loaded: winsta.dll
Source: C:\Windows\System32\taskkill.exeSection loaded: amsi.dll
Source: C:\Windows\System32\taskkill.exeSection loaded: userenv.dll
Source: C:\Windows\System32\taskkill.exeSection loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: profapi.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: vbscript.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: sxs.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: profapi.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: vbscript.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: sxs.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: profapi.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: vbscript.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: sxs.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: profapi.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: vbscript.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: sxs.dll
Source: C:\Windows\System32\wbem\WMIC.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32Jump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\tasklist.exe tasklist
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll
Source: 1.exeStatic PE information: Image base 0x140000000 > 0x60000000
Source: 1.exeStatic file information: File size 25435744 > 1048576
Source: 1.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: 1.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: 1.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: 1.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: 1.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: 1.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
Source: 1.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Source: 1.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: api-ms-win-crt-locale-l1-1-0.pdb source: 1.exe, 00000000.00000003.2142968513.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-crt-runtime-l1-1-0.pdb source: 1.exe, 00000000.00000003.2143265512.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-file-l1-2-0.pdb source: 1.exe, 00000000.00000003.2140777254.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-memory-l1-1-0.pdb source: 1.exe, 00000000.00000003.2141418951.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-debug-l1-1-0.pdb source: 1.exe, 00000000.00000003.2140544033.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-sysinfo-l1-1-0.pdb source: 1.exe, 00000000.00000003.2142382964.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-crt-filesystem-l1-1-0.pdb source: 1.exe, 00000000.00000003.2142817399.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-crt-stdio-l1-1-0.pdb source: 1.exe, 00000000.00000003.2143334365.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdbGCTL source: 1.exe, 00000000.00000003.2131826778.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_multiprocessing.pdb source: 1.exe, 00000000.00000003.2139072724.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-heap-l1-1-0.pdb source: 1.exe, 00000000.00000003.2141003458.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdb source: 1.exe, 00000000.00000003.2132886454.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-util-l1-1-0.pdb source: 1.exe, 00000000.00000003.2142525333.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-synch-l1-1-0.pdb source: 1.exe, 00000000.00000003.2142237741.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-crt-environment-l1-1-0.pdb source: 1.exe, 00000000.00000003.2142745850.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-errorhandling-l1-1-0.pdb source: 1.exe, 00000000.00000003.2140622674.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_hashlib.pdb source: 1.exe, 00000000.00000003.2137189149.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-processthreads-l1-1-0.pdb source: 1.exe, 00000000.00000003.2141655577.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-console-l1-1-0.pdb source: 1.exe, 00000000.00000003.2140377919.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-file-l1-1-0.pdb source: 1.exe, 00000000.00000003.2140699760.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_asyncio.pdb source: 1.exe, 00000000.00000003.2132982549.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-crt-convert-l1-1-0.pdb source: 1.exe, 00000000.00000003.2142669958.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_lzma.pdb source: 1.exe, 00000000.00000003.2138600147.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_bz2.pdb source: 1.exe, 00000000.00000003.2134334170.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-profile-l1-1-0.pdb source: 1.exe, 00000000.00000003.2141831695.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_socket.pdb source: 1.exe, 00000000.00000003.2139833055.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdbGCTL source: 1.exe, 00000000.00000003.2132886454.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-crt-time-l1-1-0.pdb source: 1.exe, 00000000.00000003.2143485995.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-handle-l1-1-0.pdb source: 1.exe, 00000000.00000003.2140922599.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\unicodedata.pdb source: 1.exe, 00000000.00000003.2155530941.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-synch-l1-2-0.pdb source: 1.exe, 00000000.00000003.2142313193.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-processenvironment-l1-1-0.pdb source: 1.exe, 00000000.00000003.2141572961.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-datetime-l1-1-0.pdb source: 1.exe, 00000000.00000003.2140462716.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_overlapped.pdb source: 1.exe, 00000000.00000003.2139356733.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-crt-conio-l1-1-0.pdb source: 1.exe, 00000000.00000003.2142599569.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: 1.exe, 00000000.00000003.2131826778.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-311\Release\win32trace.pdb source: 1.exe, 00000000.00000003.2156359102.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-localization-l1-2-0.pdb source: 1.exe, 00000000.00000003.2141336946.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-crt-math-l1-1-0.pdb source: 1.exe, 00000000.00000003.2143041232.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-processthreads-l1-1-1.pdb source: 1.exe, 00000000.00000003.2141736865.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\select.pdb source: 1.exe, 00000000.00000003.2153685705.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-namedpipe-l1-1-0.pdb source: 1.exe, 00000000.00000003.2141498347.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-crt-multibyte-l1-1-0.pdb source: 1.exe, 00000000.00000003.2143117515.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-crt-utility-l1-1-0.pdb source: 1.exe, 00000000.00000003.2143561263.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-rtlsupport-l1-1-0.pdb source: 1.exe, 00000000.00000003.2141929537.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-timezone-l1-1-0.pdb source: 1.exe, 00000000.00000003.2142454218.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-string-l1-1-0.pdb source: 1.exe, 00000000.00000003.2142163746.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-file-l2-1-0.pdb source: 1.exe, 00000000.00000003.2140851936.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_lzma.pdbNN source: 1.exe, 00000000.00000003.2138600147.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-crt-process-l1-1-0.pdb source: 1.exe, 00000000.00000003.2143194031.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-libraryloader-l1-1-0.pdb source: 1.exe, 00000000.00000003.2141252511.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_uuid.pdb source: 1.exe, 00000000.00000003.2140281789.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_queue.pdb source: 1.exe, 00000000.00000003.2139745215.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-interlocked-l1-1-0.pdb source: 1.exe, 00000000.00000003.2141074156.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-interlocked-l1-1-0.dll.0.dr
Source: Binary string: D:\a\1\b\bin\amd64\python3.pdb source: 1.exe, 00000000.00000003.2151337499.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-crt-heap-l1-1-0.pdb source: 1.exe, 00000000.00000003.2142891494.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-crt-string-l1-1-0.pdb source: 1.exe, 00000000.00000003.2143412270.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp
Source: 1.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: 1.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: 1.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: 1.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: 1.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Data Obfuscation

barindex
Suspicious powershell command line found
Source: C:\Users\user\Desktop\1.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
Source: C:\Users\user\Desktop\1.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
Source: C:\Users\user\Desktop\1.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefaultJump to behavior
Source: C:\Users\user\Desktop\1.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductNameJump to behavior
Source: api-ms-win-core-file-l1-2-0.dll.0.drStatic PE information: 0x6A762B3D [Fri Aug 7 19:00:13 2026 UTC]
Source: libcrypto-3.dll.0.drStatic PE information: section name: .00cfg
Source: libssl-3.dll.0.drStatic PE information: section name: .00cfg
Source: python311.dll.0.drStatic PE information: section name: PyRuntim
Source: mfc140u.dll.0.drStatic PE information: section name: .didat
Source: VCRUNTIME140.dll.0.drStatic PE information: section name: _RDATA
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 29_2_00007FFD326819BA pushad ; ret 29_2_00007FFD326819C9

Persistence and Installation Behavior

barindex
Found pyInstaller with non standard icon
Source: C:\Users\user\Desktop\1.exeProcess created: "C:\Users\user\Desktop\1.exe"
Uses cmd line tools excessively to alter registry or file data
Source: C:\Windows\System32\cmd.exeProcess created: reg.exe
Source: C:\Windows\System32\cmd.exeProcess created: reg.exe
Source: C:\Windows\System32\cmd.exeProcess created: reg.exeJump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: reg.exeJump to behavior
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome\Cipher\_raw_des3.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\Cipher\_raw_eksblowfish.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59682\_sqlite3.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\Hash\_SHA1.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59682\api-ms-win-crt-heap-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome\Cipher\_raw_des.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\Util\_cpuid_c.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59682\Pythonwin\win32ui.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\Cipher\_raw_arc2.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59682\python3.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59682\api-ms-win-core-string-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59682\VCRUNTIME140_1.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59682\_lzma.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome\Util\_strxor.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59682\libssl-3.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\Hash\_SHA512.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\Hash\_MD2.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59682\api-ms-win-crt-conio-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\Cipher\_ARC4.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome\Cipher\_raw_cfb.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59682\PIL\_imagingmath.cp311-win_amd64.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\Cipher\_raw_aesni.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59682\_decimal.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome\PublicKey\_x25519.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59682\api-ms-win-crt-convert-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59682\api-ms-win-core-debug-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\Cipher\_raw_aes.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\Hash\_keccak.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\Hash\_poly1305.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome\Cipher\_ARC4.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome\Cipher\_raw_ctr.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome\Hash\_MD4.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome\Hash\_SHA224.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59682\libcrypto-3.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\Math\_modexp.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome\Util\_cpuid_c.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59682\_bz2.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome\Hash\_SHA512.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\Cipher\_raw_ecb.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59682\psutil\_psutil_windows.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59682\ucrtbase.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59682\win32\win32trace.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome\Hash\_MD2.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59682\api-ms-win-core-synch-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\Cipher\_raw_des.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59682\_overlapped.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\Cipher\_raw_ofb.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59682\cryptography\hazmat\bindings\_rust.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59682\api-ms-win-core-file-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome\Hash\_SHA384.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59682\_hashlib.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome\Cipher\_raw_eksblowfish.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59682\VCRUNTIME140.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59682\_asyncio.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\Hash\_RIPEMD160.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\Util\_strxor.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\Cipher\_pkcs1_decode.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59682\api-ms-win-core-util-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59682\api-ms-win-core-console-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome\Cipher\_raw_cbc.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59682\pywin32_system32\pywintypes311.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\PublicKey\_ec_ws.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59682\libffi-8.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome\Math\_modexp.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59682\_multiprocessing.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\Hash\_SHA224.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome\Cipher\_raw_cast.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome\Cipher\_pkcs1_decode.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\PublicKey\_ed448.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59682\api-ms-win-core-processthreads-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\Hash\_MD5.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome\Cipher\_raw_ecb.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\Cipher\_raw_blowfish.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59682\pyexpat.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome\Protocol\_scrypt.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome\Hash\_BLAKE2b.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome\PublicKey\_ed25519.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\Cipher\_raw_cfb.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59682\api-ms-win-crt-utility-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59682\_socket.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome\Hash\_RIPEMD160.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59682\api-ms-win-core-errorhandling-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59682\api-ms-win-crt-math-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59682\api-ms-win-core-memory-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\Hash\_SHA384.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59682\api-ms-win-core-synch-l1-2-0.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59682\api-ms-win-core-datetime-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59682\_queue.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59682\python311.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59682\_uuid.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\PublicKey\_ed25519.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59682\api-ms-win-crt-string-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome\Cipher\_chacha20.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59682\api-ms-win-core-file-l2-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59682\win32\win32api.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59682\api-ms-win-core-interlocked-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\Hash\_SHA256.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome\Cipher\_raw_blowfish.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59682\api-ms-win-core-profile-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59682\api-ms-win-core-processenvironment-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59682\pywin32_system32\pythoncom311.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome\Hash\_SHA1.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\Cipher\_raw_des3.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59682\api-ms-win-core-heap-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59682\PIL\_imaging.cp311-win_amd64.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\PublicKey\_x25519.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome\Cipher\_raw_arc2.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59682\api-ms-win-core-sysinfo-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59682\api-ms-win-crt-runtime-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59682\api-ms-win-core-timezone-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59682\api-ms-win-core-file-l1-2-0.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59682\api-ms-win-core-namedpipe-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59682\api-ms-win-core-processthreads-l1-1-1.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\Hash\_BLAKE2s.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59682\PIL\_webp.cp311-win_amd64.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\Cipher\_raw_cbc.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59682\sqlite3.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59682\api-ms-win-core-libraryloader-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59682\unicodedata.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59682\win32\_win32sysloader.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59682\_cffi_backend.cp311-win_amd64.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome\Hash\_SHA256.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\Cipher\_raw_ocb.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\Hash\_BLAKE2b.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59682\Pythonwin\mfc140u.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59682\api-ms-win-crt-multibyte-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59682\api-ms-win-crt-filesystem-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59682\PIL\_imagingcms.cp311-win_amd64.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\Cipher\_chacha20.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59682\charset_normalizer\md.cp311-win_amd64.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome\Hash\_BLAKE2s.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\Cipher\_raw_cast.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59682\api-ms-win-core-handle-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59682\api-ms-win-crt-time-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome\Cipher\_Salsa20.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59682\api-ms-win-crt-environment-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\Cipher\_Salsa20.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59682\PIL\_imagingtk.cp311-win_amd64.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59682\api-ms-win-crt-locale-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome\PublicKey\_ed448.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59682\api-ms-win-core-rtlsupport-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59682\win32com\shell\shell.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\Hash\_ghash_clmul.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome\Hash\_MD5.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome\PublicKey\_ec_ws.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59682\select.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59682\_ctypes.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59682\api-ms-win-crt-stdio-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome\Cipher\_raw_ofb.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome\Hash\_ghash_clmul.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome\Cipher\_raw_aesni.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\Hash\_ghash_portable.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59682\charset_normalizer\md__mypyc.cp311-win_amd64.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\Cipher\_raw_ctr.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59682\api-ms-win-crt-process-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\Protocol\_scrypt.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome\Hash\_ghash_portable.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59682\api-ms-win-core-localization-l1-2-0.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\Hash\_MD4.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59682\_ssl.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome\Cipher\_raw_aes.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome\Hash\_poly1305.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome\Cipher\_raw_ocb.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59682\win32\win32crypt.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome\Hash\_keccak.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeCode function: 0_2_00007FF7E93A6EA0 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,0_2_00007FF7E93A6EA0
Source: C:\Windows\System32\wbem\WMIC.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\wbem\WMIC.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\tasklist.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\1.exeRegistry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\disk\Enum name: 0Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 2884
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 2340
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 4279
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 3006
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome\Cipher\_raw_des3.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\Cipher\_raw_eksblowfish.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59682\_sqlite3.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59682\api-ms-win-crt-heap-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\Hash\_SHA1.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome\Cipher\_raw_des.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\Util\_cpuid_c.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59682\Pythonwin\win32ui.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\Cipher\_raw_arc2.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59682\python3.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59682\api-ms-win-core-string-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59682\_lzma.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome\Util\_strxor.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\Hash\_SHA512.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\Hash\_MD2.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59682\api-ms-win-crt-conio-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59682\PIL\_imagingmath.cp311-win_amd64.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome\Cipher\_raw_cfb.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\Cipher\_ARC4.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\Cipher\_raw_aesni.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59682\_decimal.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome\PublicKey\_x25519.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59682\api-ms-win-crt-convert-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59682\api-ms-win-core-debug-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\Cipher\_raw_aes.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\Hash\_keccak.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\Hash\_poly1305.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome\Cipher\_ARC4.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome\Cipher\_raw_ctr.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome\Hash\_MD4.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome\Hash\_SHA224.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome\Util\_cpuid_c.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59682\_bz2.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\Math\_modexp.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome\Hash\_SHA512.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59682\win32\win32trace.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\Cipher\_raw_ecb.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59682\psutil\_psutil_windows.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome\Hash\_MD2.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59682\api-ms-win-core-synch-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\Cipher\_raw_des.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59682\_overlapped.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\Cipher\_raw_ofb.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59682\cryptography\hazmat\bindings\_rust.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59682\api-ms-win-core-file-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59682\_hashlib.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome\Hash\_SHA384.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome\Cipher\_raw_eksblowfish.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59682\_asyncio.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\Util\_strxor.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\Hash\_RIPEMD160.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\Cipher\_pkcs1_decode.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59682\api-ms-win-core-util-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59682\api-ms-win-core-console-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59682\pywin32_system32\pywintypes311.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome\Cipher\_raw_cbc.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\PublicKey\_ec_ws.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome\Math\_modexp.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59682\_multiprocessing.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\Hash\_SHA224.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome\Cipher\_raw_cast.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome\Cipher\_pkcs1_decode.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\PublicKey\_ed448.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\Hash\_MD5.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59682\api-ms-win-core-processthreads-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome\Cipher\_raw_ecb.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59682\pyexpat.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome\Protocol\_scrypt.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\Cipher\_raw_blowfish.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome\Hash\_BLAKE2b.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome\PublicKey\_ed25519.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\Cipher\_raw_cfb.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59682\_socket.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59682\api-ms-win-crt-utility-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome\Hash\_RIPEMD160.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59682\api-ms-win-core-errorhandling-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59682\api-ms-win-crt-math-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59682\api-ms-win-core-memory-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\Hash\_SHA384.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59682\api-ms-win-core-synch-l1-2-0.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59682\api-ms-win-core-datetime-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59682\_queue.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59682\python311.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59682\_uuid.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59682\api-ms-win-crt-string-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome\Cipher\_chacha20.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\PublicKey\_ed25519.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59682\api-ms-win-core-file-l2-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59682\win32\win32api.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59682\api-ms-win-core-interlocked-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\Hash\_SHA256.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome\Cipher\_raw_blowfish.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59682\api-ms-win-core-profile-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59682\api-ms-win-core-processenvironment-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59682\pywin32_system32\pythoncom311.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome\Hash\_SHA1.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\Cipher\_raw_des3.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59682\api-ms-win-core-heap-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59682\PIL\_imaging.cp311-win_amd64.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome\Cipher\_raw_arc2.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\PublicKey\_x25519.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59682\api-ms-win-core-sysinfo-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59682\api-ms-win-crt-runtime-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59682\api-ms-win-core-timezone-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59682\api-ms-win-core-file-l1-2-0.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59682\api-ms-win-core-namedpipe-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59682\api-ms-win-core-processthreads-l1-1-1.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\Hash\_BLAKE2s.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59682\PIL\_webp.cp311-win_amd64.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\Cipher\_raw_cbc.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59682\api-ms-win-core-libraryloader-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59682\unicodedata.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59682\win32\_win32sysloader.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59682\_cffi_backend.cp311-win_amd64.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome\Hash\_SHA256.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\Cipher\_raw_ocb.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\Hash\_BLAKE2b.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59682\Pythonwin\mfc140u.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59682\api-ms-win-crt-multibyte-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59682\PIL\_imagingcms.cp311-win_amd64.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59682\api-ms-win-crt-filesystem-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome\Hash\_BLAKE2s.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\Cipher\_chacha20.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59682\charset_normalizer\md.cp311-win_amd64.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\Cipher\_raw_cast.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome\Cipher\_Salsa20.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59682\api-ms-win-crt-time-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59682\api-ms-win-core-handle-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59682\api-ms-win-crt-environment-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\Cipher\_Salsa20.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59682\PIL\_imagingtk.cp311-win_amd64.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59682\api-ms-win-crt-locale-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome\PublicKey\_ed448.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59682\api-ms-win-core-rtlsupport-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59682\win32com\shell\shell.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\Hash\_ghash_clmul.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome\PublicKey\_ec_ws.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome\Hash\_MD5.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59682\_ctypes.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59682\select.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome\Cipher\_raw_ofb.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome\Hash\_ghash_clmul.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59682\api-ms-win-crt-stdio-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome\Cipher\_raw_aesni.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\Hash\_ghash_portable.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59682\charset_normalizer\md__mypyc.cp311-win_amd64.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59682\api-ms-win-crt-process-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\Cipher\_raw_ctr.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\Protocol\_scrypt.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome\Hash\_ghash_portable.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59682\api-ms-win-core-localization-l1-2-0.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\Hash\_MD4.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59682\_ssl.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome\Cipher\_raw_aes.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome\Hash\_poly1305.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome\Cipher\_raw_ocb.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome\Hash\_keccak.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI59682\win32\win32crypt.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeCheck user administrative privileges: GetTokenInformation,DecisionNodesgraph_0-18067
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5132Thread sleep count: 2884 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5904Thread sleep count: 2340 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6136Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6116Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1456Thread sleep count: 4279 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6912Thread sleep count: 209 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5292Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5388Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6428Thread sleep count: 3006 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6428Thread sleep count: 192 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4044Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5672Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\wbem\WMIC.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT UUID FROM Win32_ComputerSystemProduct
Source: C:\Windows\System32\wbem\WMIC.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT TotalPhysicalMemory FROM Win32_ComputerSystem
Source: C:\Windows\System32\wbem\WMIC.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT UUID FROM Win32_ComputerSystemProduct
Source: C:\Windows\System32\wbem\WMIC.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Name FROM WIN32_PROCESSOR
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Users\user\Desktop\1.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeCode function: 0_2_00007FF7E93A79B0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,0_2_00007FF7E93A79B0
Source: C:\Users\user\Desktop\1.exeCode function: 0_2_00007FF7E93A85A0 FindFirstFileExW,FindClose,0_2_00007FF7E93A85A0
Source: C:\Users\user\Desktop\1.exeCode function: 0_2_00007FF7E93C0B84 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,0_2_00007FF7E93C0B84
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: 1.exe, 00000002.00000003.2348035481.0000026ABD523000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: 1.exe, 00000000.00000003.2144107763.00000239A9B54000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: j2aTPs+9xYa9+bG3tD60B8jzljHz7aRP+KNOjSkVWLjVb3/ubCK1sK9IRQq9qEmU
Source: 1.exe, 00000002.00000003.2348035481.0000026ABD523000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: secure.bankofamerica.comVMware20,11696487552|UE
Source: 1.exe, 00000002.00000003.2348035481.0000026ABD523000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: 1.exe, 00000002.00000003.2348035481.0000026ABD523000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: discord.comVMware20,11696487552f
Source: 1.exe, 00000002.00000003.2348035481.0000026ABD523000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: bankofamerica.comVMware20,11696487552x
Source: 1.exe, 00000002.00000003.2348035481.0000026ABD523000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: 1.exe, 00000002.00000003.2348035481.0000026ABD523000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ms.portal.azure.comVMware20,11696487552
Source: 1.exe, 00000002.00000003.2348035481.0000026ABD523000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: 1.exe, 00000002.00000003.3002304374.0000026AB891F000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3003595618.0000026AB8931000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWj
Source: 1.exe, 00000002.00000003.2348035481.0000026ABD523000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: 1.exe, 00000002.00000003.2348035481.0000026ABD523000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: global block list test formVMware20,11696487552
Source: 1.exe, 00000002.00000003.2348035481.0000026ABD523000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: tasks.office.comVMware20,11696487552o
Source: 1.exe, 00000002.00000003.2348035481.0000026ABD523000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: AMC password management pageVMware20,11696487552
Source: 1.exe, 00000002.00000003.2348035481.0000026ABD523000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: 1.exe, 00000002.00000003.2348035481.0000026ABD523000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: interactivebrokers.comVMware20,11696487552
Source: 1.exe, 00000002.00000003.2348035481.0000026ABD523000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: dev.azure.comVMware20,11696487552j
Source: 1.exe, 00000002.00000003.2348035481.0000026ABD523000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: 1.exe, 00000002.00000003.2348035481.0000026ABD523000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: 1.exe, 00000002.00000003.2348035481.0000026ABD523000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: 1.exe, 00000002.00000003.2348035481.0000026ABD523000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: 1.exe, 00000002.00000003.2348035481.0000026ABD523000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: 1.exe, 00000002.00000003.2348035481.0000026ABD523000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: 1.exe, 00000002.00000003.2348035481.0000026ABD523000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: outlook.office365.comVMware20,11696487552t
Source: 1.exe, 00000002.00000003.2348035481.0000026ABD523000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: 1.exe, 00000002.00000003.2348035481.0000026ABD523000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: 1.exe, 00000002.00000003.2348035481.0000026ABD523000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: 1.exe, 00000002.00000003.2348035481.0000026ABD523000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: outlook.office.comVMware20,11696487552s
Source: 1.exe, 00000002.00000003.2348035481.0000026ABD523000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: 1.exe, 00000002.00000003.2348035481.0000026ABD523000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: 1.exe, 00000002.00000003.2348035481.0000026ABD523000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: 1.exe, 00000002.00000003.2348035481.0000026ABD523000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: 1.exe, 00000002.00000003.2348035481.0000026ABD523000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552
Source: C:\Users\user\Desktop\1.exeProcess information queried: ProcessInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeCode function: 0_2_00007FF7E93B9924 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_00007FF7E93B9924
Source: C:\Users\user\Desktop\1.exeCode function: 0_2_00007FF7E93C2790 GetProcessHeap,0_2_00007FF7E93C2790
Source: C:\Users\user\Desktop\1.exeProcess token adjusted: DebugJump to behavior
Source: C:\Users\user\Desktop\1.exeProcess token adjusted: DebugJump to behavior
Source: C:\Windows\System32\tasklist.exeProcess token adjusted: DebugJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
Source: C:\Windows\System32\taskkill.exeProcess token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
Source: C:\Users\user\Desktop\1.exeCode function: 0_2_00007FF7E93B9924 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_00007FF7E93B9924
Source: C:\Users\user\Desktop\1.exeCode function: 0_2_00007FF7E93AC44C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_00007FF7E93AC44C
Source: C:\Users\user\Desktop\1.exeCode function: 0_2_00007FF7E93ABBC0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,0_2_00007FF7E93ABBC0
Source: C:\Users\user\Desktop\1.exeCode function: 0_2_00007FF7E93AC62C SetUnhandledExceptionFilter,0_2_00007FF7E93AC62C
Source: C:\Users\user\Desktop\1.exeProcess created: C:\Users\user\Desktop\1.exe "C:\Users\user\Desktop\1.exe"Jump to behavior
Source: C:\Users\user\Desktop\1.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "ver"Jump to behavior
Source: C:\Users\user\Desktop\1.exeProcess created: C:\Windows\System32\wbem\WMIC.exe wmic path win32_VideoController get nameJump to behavior
Source: C:\Users\user\Desktop\1.exeProcess created: C:\Windows\System32\wbem\WMIC.exe wmic csproduct get uuidJump to behavior
Source: C:\Users\user\Desktop\1.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2> nulJump to behavior
Source: C:\Users\user\Desktop\1.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2> nulJump to behavior
Source: C:\Users\user\Desktop\1.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"Jump to behavior
Source: C:\Users\user\Desktop\1.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist"Jump to behavior
Source: C:\Users\user\Desktop\1.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"Jump to behavior
Source: C:\Users\user\Desktop\1.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2> nulJump to behavior
Source: C:\Users\user\Desktop\1.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefaultJump to behavior
Source: C:\Users\user\Desktop\1.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductNameJump to behavior
Source: C:\Users\user\Desktop\1.exeProcess created: C:\Windows\System32\wbem\WMIC.exe wmic cpu get nameJump to behavior
Source: C:\Users\user\Desktop\1.exeProcess created: C:\Windows\System32\wbem\WMIC.exe wmic path win32_VideoController get nameJump to behavior
Source: C:\Users\user\Desktop\1.exeProcess created: C:\Windows\System32\wbem\WMIC.exe wmic computersystem get TotalPhysicalMemoryJump to behavior
Source: C:\Users\user\Desktop\1.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\WMIC.exe csproduct get uuid"Jump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\reg.exe REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDescJump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\reg.exe REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderNameJump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ClipboardJump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\tasklist.exe tasklistJump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wbem\WMIC.exe WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayNameJump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\taskkill.exe taskkill /f /im exodus.exe
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wbem\WMIC.exe C:\Windows\System32\wbem\WMIC.exe csproduct get uuid
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\taskkill.exe taskkill /f /im exodus.exe
Source: C:\Users\user\Desktop\1.exeCode function: 0_2_00007FF7E93C8880 cpuid 0_2_00007FF7E93C8880
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\Cipher VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\Cipher VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\Cipher VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\Cipher VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\Cipher VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\Hash VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\Hash VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\Hash VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\Hash VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\Hash VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\Hash VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\Hash VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\PublicKey VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\PublicKey VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\PublicKey VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\Util VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome\Cipher VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome\Cipher VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome\Cipher VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome\Cipher VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome\Cipher VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome\Hash VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome\PublicKey VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome\Util VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\PIL VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\PIL VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\PIL VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\cryptography-43.0.0.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\cryptography-43.0.0.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\cryptography-43.0.0.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\cryptography-43.0.0.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\cryptography-43.0.0.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\cryptography-43.0.0.dist-info\license_files VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\cryptography-43.0.0.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\cryptography-43.0.0.dist-info\license_files VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\pywin32_system32 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\setuptools-65.5.0.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\setuptools-65.5.0.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\setuptools-65.5.0.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\setuptools-65.5.0.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\win32 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\win32 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\win32 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\ucrtbase.dll VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\_ctypes.pyd VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\_bz2.pyd VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\win32 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\Pythonwin VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\api-ms-win-core-console-l1-1-0.dll VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\api-ms-win-core-file-l1-1-0.dll VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\api-ms-win-core-file-l1-2-0.dll VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\api-ms-win-core-file-l2-1-0.dll VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\api-ms-win-core-synch-l1-1-0.dll VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\api-ms-win-core-synch-l1-2-0.dll VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\api-ms-win-core-timezone-l1-1-0.dll VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\api-ms-win-core-util-l1-1-0.dll VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\api-ms-win-crt-environment-l1-1-0.dll VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\api-ms-win-crt-heap-l1-1-0.dll VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\api-ms-win-crt-math-l1-1-0.dll VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\api-ms-win-crt-process-l1-1-0.dll VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\win32 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\win32 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\Pythonwin VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\pywin32_system32 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\pywin32_system32 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\pywin32_system32 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\Pythonwin VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\pyexpat.pyd VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\_queue.pyd VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\win32 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\Pythonwin VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\pywin32_system32 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\pywin32_system32\pywintypes311.dll VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\win32 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\Pythonwin VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\pywin32_system32 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\pywin32_system32\pythoncom311.dll VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\win32\win32api.pyd VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\win32com VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\win32com VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\win32com VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\cryptography-43.0.0.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\setuptools-65.5.0.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\setuptools-65.5.0.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\setuptools-65.5.0.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\cryptography-43.0.0.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\cryptography-43.0.0.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\setuptools-65.5.0.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\setuptools-65.5.0.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\setuptools-65.5.0.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\_ssl.pyd VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\_asyncio.pyd VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\pywin32_system32 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI59682\pywin32_system32 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\ VolumeInformation
Source: C:\Users\user\Desktop\1.exeCode function: 0_2_00007FF7E93AC330 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,0_2_00007FF7E93AC330
Source: C:\Users\user\Desktop\1.exeCode function: 0_2_00007FF7E93C4F10 _get_daylight,_get_daylight,_get_daylight,_get_daylight,_get_daylight,GetTimeZoneInformation,0_2_00007FF7E93C4F10
Source: C:\Windows\System32\wbem\WMIC.exeWMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT displayName FROM AntivirusProduct

Stealing of Sensitive Information

barindex
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Source: C:\Users\user\Desktop\1.exeKey opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\SessionsJump to behavior
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemgJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\gleanJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\glean\pending_pingsJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\ls-archive.sqliteJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\protections.sqliteJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\permissions.sqliteJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\to-be-removedJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web DataJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\sessionstore-backupsJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqliteJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-releaseJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdoJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajbJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension SettingsJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqliteJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofecJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\CookiesJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HistoryJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\content-prefs.sqliteJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\0absryc3.defaultJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idbJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgppJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpaJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\bookmarkbackupsJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.filesJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.filesJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\minidumpsJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanentJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjpJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\BookmarksJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknnJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaadJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\crashes\eventsJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\glean\eventsJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.logJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneecJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.filesJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\HistoryJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\saved-telemetry-pingsJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\ProfilesJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\archivedJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqliteJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\security_stateJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\2918063365piupsah.filesJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdmaJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\crashesJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqliteJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqliteJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgkJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\webappsstore.sqliteJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\glean\tmpJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnnegphlobjdpkhecapkijjdkgcjhkibJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.filesJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhmJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nphplpgoakhhjchkkhmiggakijnkhfndJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\CookiesJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjihJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storageJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pdadjkfkgcafgbceimcpbkalnfnepbnkJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login DataJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\favicons.sqliteJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdnoJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hmeobnfnfcmdkdcmlblgagmfpfboieafJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbaiJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\archived\2023-10Jump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login DataJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage.sqliteJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\DefaultJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareportingJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\3561288849sdhlie.filesJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chromeJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqliteJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqliteJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\glean\dbJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqliteJump to behavior
Tries to harvest and steal ftp login credentials
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xmlJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Roaming\FileZilla\sitemanager.xmlJump to behavior
Tries to steal Crypto Currency Wallets
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Roaming\Bitcoin\walletsJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file_0.indexeddb.leveldbJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Roaming\Exodus\exodus.walletJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Roaming\Exodus\exodus.walletJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Roaming\Electrum\walletsJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldbJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldbJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\walletsJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\walletsJump to behavior
Tries to steal communication platform credentials (via file / registry access)
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Local\DiscordJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Local\DiscordCanaryJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Local\DiscordPTBJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Local\DiscordDevelopmentJump to behavior

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid Accounts31
Windows Management Instrumentation		1
DLL Side-Loading		1
DLL Side-Loading		1
Disable or Modify Tools		2
OS Credential Dumping		2
System Time Discovery		Remote Services1
Archive Collected Data		1
Ingress Tool Transfer		Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault Accounts1
Native API		Boot or Logon Initialization Scripts11
Process Injection		1
Deobfuscate/Decode Files or Information		1
Credentials in Registry		1
File and Directory Discovery		Remote Desktop Protocol3
Data from Local System		12
Encrypted Channel		Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain Accounts1
Command and Scripting Interpreter		Logon Script (Windows)Logon Script (Windows)2
Obfuscated Files or Information		Security Account Manager34
System Information Discovery		SMB/Windows Admin Shares1
Email Collection		2
Non-Application Layer Protocol		Automated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal Accounts1
PowerShell		Login HookLogin Hook1
Timestomp		NTDS61
Security Software Discovery		Distributed Component Object Model1
Clipboard Data		3
Application Layer Protocol		Traffic DuplicationData Destruction
Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script1
DLL Side-Loading		LSA Secrets2
Process Discovery		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts1
Modify Registry		Cached Domain Credentials51
Virtualization/Sandbox Evasion		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items51
Virtualization/Sandbox Evasion		DCSync1
Application Window Discovery		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job11
Process Injection		Proc Filesystem1
System Network Configuration Discovery		Cloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1585170 Sample: 1.exe Startdate: 07/01/2025 Architecture: WINDOWS Score: 96 52 transfer.sh 2->52 54 tiktok.com 2->54 56 4 other IPs or domains 2->56 66 Antivirus / Scanner detection for submitted sample 2->66 68 Multi AV Scanner detection for submitted file 2->68 70 Drops password protected ZIP file 2->70 72 AI detected suspicious sample 2->72 9 1.exe 213 2->9         started        signatures3 process4 file5 44 C:\Users\user\AppData\Local\...\shell.pyd, PE32+ 9->44 dropped 46 C:\Users\user\AppData\...\win32trace.pyd, PE32+ 9->46 dropped 48 C:\Users\user\AppData\...\win32crypt.pyd, PE32+ 9->48 dropped 50 162 other files (none is malicious) 9->50 dropped 74 Suspicious powershell command line found 9->74 76 Found pyInstaller with non standard icon 9->76 13 1.exe 30 9->13         started        signatures6 process7 dnsIp8 58 ip-api.com 208.95.112.1, 49755, 80 TUT-ASUS United States 13->58 60 idefasoft.fr 151.80.152.246, 443, 49722, 49761 OVHFR Italy 13->60 62 4 other IPs or domains 13->62 78 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 13->78 80 Suspicious powershell command line found 13->80 82 Tries to harvest and steal ftp login credentials 13->82 84 3 other signatures 13->84 17 cmd.exe 1 13->17         started        20 cmd.exe 1 13->20         started        22 cmd.exe 1 13->22         started        24 12 other processes 13->24 signatures9 process10 signatures11 64 Uses cmd line tools excessively to alter registry or file data 17->64 26 conhost.exe 17->26         started        28 reg.exe 1 17->28         started        30 conhost.exe 20->30         started        32 reg.exe 1 20->32         started        34 conhost.exe 22->34         started        36 conhost.exe 24->36         started        38 conhost.exe 24->38         started        40 conhost.exe 24->40         started        42 14 other processes 24->42 process12

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
1.exe42%ReversingLabsWin64.Trojan.ReverseShell
1.exe51%VirustotalBrowse
1.exe100%AviraTR/PSW.Agent.buior

Dropped Files

SourceDetectionScannerLabelLink
C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\Cipher\_ARC4.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\Cipher\_Salsa20.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\Cipher\_chacha20.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\Cipher\_pkcs1_decode.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\Cipher\_raw_aes.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\Cipher\_raw_aesni.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\Cipher\_raw_arc2.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\Cipher\_raw_blowfish.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\Cipher\_raw_cast.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\Cipher\_raw_cbc.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\Cipher\_raw_cfb.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\Cipher\_raw_ctr.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\Cipher\_raw_des.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\Cipher\_raw_des3.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\Cipher\_raw_ecb.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\Cipher\_raw_eksblowfish.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\Cipher\_raw_ocb.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\Cipher\_raw_ofb.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\Hash\_BLAKE2b.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\Hash\_BLAKE2s.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\Hash\_MD2.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\Hash\_MD4.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\Hash\_MD5.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\Hash\_RIPEMD160.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\Hash\_SHA1.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\Hash\_SHA224.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\Hash\_SHA256.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\Hash\_SHA384.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\Hash\_SHA512.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\Hash\_ghash_clmul.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\Hash\_ghash_portable.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\Hash\_keccak.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\Hash\_poly1305.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\Math\_modexp.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\Protocol\_scrypt.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\PublicKey\_ec_ws.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\PublicKey\_ed25519.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\PublicKey\_ed448.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\PublicKey\_x25519.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\Util\_cpuid_c.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\Util\_strxor.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome\Cipher\_ARC4.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome\Cipher\_Salsa20.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome\Cipher\_chacha20.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome\Cipher\_pkcs1_decode.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome\Cipher\_raw_aes.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome\Cipher\_raw_aesni.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome\Cipher\_raw_arc2.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome\Cipher\_raw_blowfish.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome\Cipher\_raw_cast.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome\Cipher\_raw_cbc.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome\Cipher\_raw_cfb.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome\Cipher\_raw_ctr.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome\Cipher\_raw_des.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome\Cipher\_raw_des3.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome\Cipher\_raw_ecb.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome\Cipher\_raw_eksblowfish.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome\Cipher\_raw_ocb.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome\Cipher\_raw_ofb.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome\Hash\_BLAKE2b.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome\Hash\_BLAKE2s.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome\Hash\_MD2.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome\Hash\_MD4.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome\Hash\_MD5.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome\Hash\_RIPEMD160.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome\Hash\_SHA1.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome\Hash\_SHA224.pyd0%ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

SourceDetectionScannerLabelLink
https://tidelift.com/security0%Avira URL Cloudsafe
http://repository.swisssign.com/er0%Avira URL Cloudsafe
http://cacerts.digicert.cog0%Avira URL Cloudsafe
http://repository.swisssign.com/p0%Avira URL Cloudsafe
http://repository.swisssign.com/uw0%Avira URL Cloudsafe
https://boxmatrix.info/wiki/Property:arping0%Avira URL Cloudsafe
https://discordverify.tech/webhooks/hyzen_exod/0%Avira URL Cloudsafe
https://tidelift.com/subscription/pkg/pypi-setuptools?utm_source=pypi-setuptools&utm_medium=referral0%Avira URL Cloudsafe

Domains and IPs

Contacted Domains

NameIPActiveMaliciousAntivirus DetectionReputation
idefasoft.fr
151.80.152.246
truefalse
    		unknown
    tiktok.com
    		18.66.112.109
    		truefalse
      		high
      ipinfo.io
      		34.117.59.81
      		truefalse
        		high
        ip-api.com
        		208.95.112.1
        		truefalse
          		high
          transfer.sh
          		144.76.136.153
          		truefalse
            		high
            api.gofile.io
            		45.112.123.126
            		truefalse
              		high

              Contacted URLs

              NameMaliciousAntivirus DetectionReputation
              http://ip-api.com/json/?fields=hosting,queryfalse
                		high

                URLs from Memory and Binaries

                NameSourceMaliciousAntivirus DetectionReputation
                https://duckduckgo.com/chrome_newtab1.exe, 00000002.00000003.2291765845.0000026ABD135000.00000004.00000020.00020000.00000000.sdmpfalse
                  		high
                  https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-108r1.pdf1.exe, 00000002.00000003.2997011920.0000026ABB14E000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2995799183.0000026ABB127000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2353294920.0000026ABB0DE000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2993635054.0000026ABB0DE000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2280798075.0000026ABB0DE000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2996510516.0000026ABB13F000.00000004.00000020.00020000.00000000.sdmpfalse
                    		high
                    https://duckduckgo.com/ac/?q=1.exe, 00000002.00000003.2291765845.0000026ABD135000.00000004.00000020.00020000.00000000.sdmpfalse
                      		high
                      https://img.shields.io/badge/skeleton-2022-informational1.exe, 00000000.00000003.2153965322.00000239A9B54000.00000004.00000020.00020000.00000000.sdmpfalse
                        		high
                        https://github.com/mhammond/pywin321.exe, 00000000.00000003.2156102244.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2131046109.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2156359102.00000239A9B61000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2153299506.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2156359102.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2156219072.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2156481090.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2153550121.00000239A9B54000.00000004.00000020.00020000.00000000.sdmpfalse
                          		high
                          https://img.shields.io/pypi/pyversions/setuptools.svg1.exe, 00000000.00000003.2153965322.00000239A9B54000.00000004.00000020.00020000.00000000.sdmpfalse
                            		high
                            https://img.shields.io/pypi/v/setuptools.svg1.exe, 00000000.00000003.2153965322.00000239A9B54000.00000004.00000020.00020000.00000000.sdmpfalse
                              		high
                              http://docs.python.org/library/unittest.html1.exe, 00000002.00000003.2995270880.0000026ABB96E000.00000004.00000020.00020000.00000000.sdmpfalse
                                		high
                                https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#1.exe, 00000002.00000003.2158391223.0000026ABA733000.00000004.00000020.00020000.00000000.sdmpfalse
                                  		high
                                  https://github.com/pyca/cryptography/actions?query=workflow%3ACI1.exe, 00000000.00000003.2145498424.00000239A9B57000.00000004.00000020.00020000.00000000.sdmpfalse
                                    		high
                                    https://tidelift.com/security1.exe, 00000000.00000003.2153965322.00000239A9B54000.00000004.00000020.00020000.00000000.sdmpfalse
                                    • Avira URL Cloud: safe
                                    		unknown
                                    https://tools.ietf.org/html/rfc2388#section-4.41.exe, 00000002.00000003.2995270880.0000026ABBA4C000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2998754025.0000026ABBA4C000.00000004.00000020.00020000.00000000.sdmpfalse
                                      		high
                                      https://www.apache.org/licenses/LICENSE-2.01.exe, 00000000.00000003.2145969486.00000239A9B62000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2145969486.00000239A9B54000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2146073212.00000239A9B62000.00000004.00000020.00020000.00000000.sdmpfalse
                                        		high
                                        https://docs.python.org/3.11/library/binascii.html#binascii.a2b_base641.exe, 00000002.00000003.3000243404.0000026ABA7E5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3002000425.0000026ABA7EB000.00000004.00000020.00020000.00000000.sdmpfalse
                                          		high
                                          https://img.shields.io/codecov/c/github/pypa/setuptools/master.svg?logo=codecov&logoColor=white1.exe, 00000000.00000003.2153965322.00000239A9B54000.00000004.00000020.00020000.00000000.sdmpfalse
                                            		high
                                            https://github.com/pypa/packaging1.exe, 00000002.00000003.2182245662.0000026ABAEB3000.00000004.00000020.00020000.00000000.sdmpfalse
                                              		high
                                              https://github.com/pypa/setuptools1.exe, 00000000.00000003.2153965322.00000239A9B54000.00000004.00000020.00020000.00000000.sdmpfalse
                                                		high
                                                https://pypi.org/project/setuptools1.exe, 00000000.00000003.2153965322.00000239A9B54000.00000004.00000020.00020000.00000000.sdmpfalse
                                                  		high
                                                  https://github.com/pypa/setuptools/workflows/tests/badge.svg1.exe, 00000000.00000003.2153965322.00000239A9B54000.00000004.00000020.00020000.00000000.sdmpfalse
                                                    		high
                                                    https://nuget.org/nuget.exepowershell.exe, 0000001D.00000002.2339161609.000001B211E8C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001D.00000002.2322558013.000001B2037D8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001D.00000002.2339161609.000001B211FC3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001F.00000002.2409548445.000002209017C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001F.00000002.2409548445.00000220902B3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001F.00000002.2361908430.0000022081A99000.00000004.00000800.00020000.00000000.sdmpfalse
                                                      		high
                                                      https://blog.jaraco.com/skeleton1.exe, 00000000.00000003.2153965322.00000239A9B54000.00000004.00000020.00020000.00000000.sdmpfalse
                                                        		high
                                                        http://cacerts.digicert.cog1.exe, 00000000.00000003.2138600147.00000239A9B54000.00000004.00000020.00020000.00000000.sdmpfalse
                                                        • Avira URL Cloud: safe
                                                        		unknown
                                                        https://tools.ietf.org/html/rfc36101.exe, 00000002.00000003.2995270880.0000026ABBA4C000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3002928468.0000026ABBD35000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2997370247.0000026ABBADF000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3001866849.0000026ABBD2A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                          		high
                                                          https://peps.python.org/pep-0205/1.exe, 00000002.00000003.2169109816.0000026ABA8B4000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2170125233.0000026ABA8AA000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2170531315.0000026ABA8AA000.00000004.00000020.00020000.00000000.sdmpfalse
                                                            		high
                                                            http://crl.dhimyotis.com/certignarootca.crl1.exe, 00000002.00000003.2301140771.0000026ABBDFA000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2277886088.0000026ABBDFA000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2352647127.0000026ABAECC000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2353294920.0000026ABAED2000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2298450794.0000026ABBDFA000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2311139842.0000026ABBDFA000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2999964452.0000026ABBDFA000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2992893692.0000026ABAECE000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2992326469.0000026ABBDFA000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2310405179.0000026ABAED2000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2353134905.0000026ABBDFA000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2280798075.0000026ABAED2000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2306588393.0000026ABBDFA000.00000004.00000020.00020000.00000000.sdmpfalse
                                                              		high
                                                              http://ocsp.accv.es1.exe, 00000002.00000003.2999720061.0000026ABA8AC000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                		high
                                                                https://packages.debian.org/sid/iputils-arping1.exe, 00000002.00000003.2992893692.0000026ABAF88000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2993635054.0000026ABAF99000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2352647127.0000026ABAF88000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2280798075.0000026ABAF88000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2994800910.0000026ABAFBD000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2301140771.0000026ABBD66000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2306588393.0000026ABBD65000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2310405179.0000026ABAF88000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2994382349.0000026ABAFBB000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2311139842.0000026ABBD66000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2298450794.0000026ABBD66000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2994346572.0000026ABBD63000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2277886088.0000026ABBD63000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2353134905.0000026ABBD63000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                  		high
                                                                  http://schemas.xmlsoap.org/ws/2005/05/identity/claims/namepowershell.exe, 0000001D.00000002.2322558013.000001B201E11000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001F.00000002.2361908430.0000022080101000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                    		high
                                                                    https://github.com/pypa/.github/blob/main/CODE_OF_CONDUCT.md1.exe, 00000000.00000003.2153965322.00000239A9B54000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                      		high
                                                                      https://discordverify.tech/webhooks/hyzen_exod/1.exe, 00000002.00000003.2998754025.0000026ABBA4C000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                      • Avira URL Cloud: safe
                                                                      		unknown
                                                                      https://docs.python.org/3/library/pprint.html1.exe, 00000002.00000003.2353294920.0000026ABB0DE000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2993635054.0000026ABB0DE000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2181839807.0000026ABB0DE000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2280798075.0000026ABB0DE000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2185527521.0000026ABB1B2000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2996474924.0000026ABB100000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2996307404.0000026ABB0DE000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                        		high
                                                                        https://github.com/pypa/setuptools/actions?query=workflow%3A%22tests%221.exe, 00000000.00000003.2153965322.00000239A9B54000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                          		high
                                                                          https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L6881.exe, 00000002.00000003.2158391223.0000026ABA733000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                            		high
                                                                            http://crl.xrampsecurity.com/XGCA.crlC1.exe, 00000002.00000003.2306588393.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2301140771.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2992326469.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3004069377.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2311139842.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2277886088.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2353134905.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                              		high
                                                                              https://httpbin.org/get1.exe, 00000002.00000003.2306588393.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2301140771.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2992326469.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2995270880.0000026ABBA4C000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2995270880.0000026ABBC23000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3000582627.0000026ABBC53000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3000187409.0000026ABBA67000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2997607005.0000026ABBC52000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3004069377.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2311139842.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2277886088.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2997370247.0000026ABBADF000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2997370247.0000026ABBC23000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2353134905.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2998754025.0000026ABBA4C000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                		high
                                                                                http://repository.swisssign.com/uw1.exe, 00000002.00000003.2306588393.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2301140771.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2992326469.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3004069377.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2311139842.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2277886088.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2353134905.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                • Avira URL Cloud: safe
                                                                                		unknown
                                                                                http://pesterbdd.com/images/Pester.pngpowershell.exe, 0000001F.00000002.2361908430.0000022081980000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                  		high
                                                                                  https://setuptools.pypa.io/en/latest/pkg_resources.html#basic-resource-access1.exe, 00000002.00000003.3000414610.0000026ABA878000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2176303617.0000026ABA98F000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2176102647.0000026ABAF2B000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2176102647.0000026ABAEDC000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                    		high
                                                                                    http://www.apache.org/licenses/LICENSE-2.0.htmlpowershell.exe, 0000001F.00000002.2361908430.0000022081980000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                      		high
                                                                                      https://wwww.certigna.fr/autorites/0m1.exe, 00000002.00000003.2352647127.0000026ABAECC000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2353294920.0000026ABAED2000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2992893692.0000026ABAECE000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2310405179.0000026ABAED2000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2280798075.0000026ABAED2000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                        		high
                                                                                        https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader1.exe, 00000002.00000003.2158391223.0000026ABA733000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                          		high
                                                                                          https://github.com/python/cpython/issues/86361.1.exe, 00000002.00000003.2175307708.0000026ABA92F000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2173498918.0000026ABA942000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2999720061.0000026ABA8FB000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2181034075.0000026ABA917000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3001503647.0000026ABA938000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3001217368.0000026ABA919000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2172016941.0000026ABA92F000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2179579918.0000026ABA910000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2171915048.0000026ABA9D0000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2172422142.0000026ABA935000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2997745773.0000026ABA8FA000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2174618831.0000026ABA942000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2176443939.0000026ABA92F000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2172929866.0000026ABA940000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                            		high
                                                                                            https://contoso.com/Iconpowershell.exe, 0000001F.00000002.2361908430.0000022081A99000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                              		high
                                                                                              https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=1.exe, 00000002.00000003.2291765845.0000026ABD135000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                		high
                                                                                                https://httpbin.org/1.exe, 00000002.00000003.3001462320.0000026ABA7A9000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                  		high
                                                                                                  https://www.apache.org/licenses/1.exe, 00000000.00000003.2145969486.00000239A9B54000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                    		high
                                                                                                    http://repository.swisssign.com/er1.exe, 00000002.00000003.2995270880.0000026ABBA4C000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2997370247.0000026ABBADF000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                    • Avira URL Cloud: safe
                                                                                                    		unknown
                                                                                                    https://github.com/pyca/cryptography/workflows/CI/badge.svg?branch=main1.exe, 00000000.00000003.2145498424.00000239A9B57000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                      		high
                                                                                                      https://wwww.certigna.fr/autorites/1.exe, 00000002.00000003.2301140771.0000026ABBDFA000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2277886088.0000026ABBDFA000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2298450794.0000026ABBDFA000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2311139842.0000026ABBDFA000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2999964452.0000026ABBDFA000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2992326469.0000026ABBDFA000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2353134905.0000026ABBDFA000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2306588393.0000026ABBDFA000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                        		high
                                                                                                        http://repository.swisssign.com/p1.exe, 00000002.00000003.2996807987.0000026ABBC89000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2995270880.0000026ABBC89000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                        • Avira URL Cloud: safe
                                                                                                        		unknown
                                                                                                        https://codecov.io/gh/pypa/setuptools1.exe, 00000000.00000003.2153965322.00000239A9B54000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                          		high
                                                                                                          http://www.cl.cam.ac.uk/~mgk25/iso-time.html1.exe, 00000002.00000003.2179228653.0000026ABAEFB000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2178404758.0000026ABAEFB000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                            		high
                                                                                                            https://www.ecosia.org/newtab/1.exe, 00000002.00000003.2291765845.0000026ABD135000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                              		high
                                                                                                              https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br1.exe, 00000002.00000003.2304772061.0000026ABD0DC000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2293244673.0000026ABD0DC000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2299714488.0000026ABD305000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2293063439.0000026ABBF6B000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2308455792.0000026ABD305000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                		high
                                                                                                                https://github.com/Pester/Pesterpowershell.exe, 0000001F.00000002.2361908430.0000022081980000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                  		high
                                                                                                                  http://hg.python.org/cpython/file/603b4d593758/Lib/socket.py#l5351.exe, 00000002.00000003.2996807987.0000026ABBC89000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2995270880.0000026ABBC23000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3000582627.0000026ABBC53000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2997607005.0000026ABBC52000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3003232850.0000026ABBC8C000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2995270880.0000026ABBC89000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2997370247.0000026ABBC23000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                    		high
                                                                                                                    https://cryptography.io/en/latest/installation/1.exe, 00000000.00000003.2145498424.00000239A9B57000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                      		high
                                                                                                                      https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy1.exe, 00000002.00000003.2158391223.0000026ABA733000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                        		high
                                                                                                                        https://brew.sh1.exe, 00000002.00000003.2310172216.0000026ABCF4F000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2994251647.0000026ABCF59000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2277385060.0000026ABCF48000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2306171318.0000026ABCF4F000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2351954090.0000026ABCF48000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2992481017.0000026ABCF50000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                          		high
                                                                                                                          https://docs.python.org/3/library/multiprocessing.html1.exe, 00000002.00000003.2176303617.0000026ABA9DE000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2179705139.0000026ABA981000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2992785265.0000026ABA95D000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2994217265.0000026ABAA0E000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2175307708.0000026ABA9DE000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2182433260.0000026ABA95D000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2180117962.0000026ABA96E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                            		high
                                                                                                                            https://docs.python.org/3/library/re.html1.exe, 00000002.00000003.2180036404.0000026ABB055000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2310405179.0000026ABAF88000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2994382349.0000026ABAFBB000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2182150064.0000026ABAFD5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2996307404.0000026ABB0DE000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3003947861.0000026ABAEB0000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2280798075.0000026ABAED2000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3003851740.0000026ABAFDF000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                              		high
                                                                                                                              http://github.com/ActiveState/appdirs1.exe, 00000002.00000003.2178691193.0000026ABAF4F000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2178404758.0000026ABAF4F000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                		high
                                                                                                                                https://wiki.debian.org/XDGBaseDirectorySpecification#state1.exe, 00000002.00000003.3003096126.0000026ABA778000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3000818569.0000026ABA748000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                  		high
                                                                                                                                  http://crl.securetrust.com/STCA.crl1.exe, 00000002.00000003.2306588393.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2301140771.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2992326469.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3004069377.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2311139842.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2277886088.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2353134905.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                    		high
                                                                                                                                    http://wwwsearch.sf.net/):1.exe, 00000002.00000003.2997011920.0000026ABB14E000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2995799183.0000026ABB127000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2353294920.0000026ABB0DE000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2993635054.0000026ABB0DE000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2280798075.0000026ABB0DE000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2996510516.0000026ABB13F000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                      		high
                                                                                                                                      https://bugzilla.mo1.exe, 00000002.00000003.2352031794.0000026ABBF5E000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2993523199.0000026ABBF61000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                        		high
                                                                                                                                        https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt1.exe, 00000002.00000003.2304772061.0000026ABD0DC000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2293244673.0000026ABD0DC000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2299714488.0000026ABD305000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2293063439.0000026ABBF6B000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2308455792.0000026ABD305000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                          		high
                                                                                                                                          http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1.crt01.exe, 00000002.00000003.2999720061.0000026ABA8AC000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2306588393.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2301140771.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2992326469.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3004069377.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2311139842.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2277886088.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2353134905.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                            		high
                                                                                                                                            http://www.accv.es/legislacion_c.htm1.exe, 00000002.00000003.2301140771.0000026ABBDFA000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2277886088.0000026ABBDFA000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2298450794.0000026ABBDFA000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2311139842.0000026ABBDFA000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2999964452.0000026ABBDFA000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2992326469.0000026ABBDFA000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2353134905.0000026ABBDFA000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2306588393.0000026ABBDFA000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                              		high
                                                                                                                                              https://cryptography.io/en/latest/security/1.exe, 00000000.00000003.2145498424.00000239A9B57000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                		high
                                                                                                                                                http://crl.xrampsecurity.com/XGCA.crl01.exe, 00000002.00000003.2992893692.0000026ABAF88000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2993635054.0000026ABAF99000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2352647127.0000026ABAF88000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2280798075.0000026ABAF88000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2994800910.0000026ABAFBD000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2310405179.0000026ABAF88000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2994382349.0000026ABAFBB000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                  		high
                                                                                                                                                  http://www.cert.fnmt.es/dpcs/1.exe, 00000002.00000003.2301140771.0000026ABBDFA000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2277886088.0000026ABBDFA000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2298450794.0000026ABBDFA000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2311139842.0000026ABBDFA000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2999964452.0000026ABBDFA000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2992326469.0000026ABBDFA000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2353134905.0000026ABBDFA000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2306588393.0000026ABBDFA000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                    		high
                                                                                                                                                    https://boxmatrix.info/wiki/Property:arping1.exe, 00000002.00000003.2992893692.0000026ABAF88000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2993635054.0000026ABAF99000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2352647127.0000026ABAF88000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2280798075.0000026ABAF88000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2994800910.0000026ABAFBD000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2301140771.0000026ABBD66000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2306588393.0000026ABBD65000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2310405179.0000026ABAF88000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2994382349.0000026ABAFBB000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2311139842.0000026ABBD66000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2298450794.0000026ABBD66000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2994346572.0000026ABBD63000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2277886088.0000026ABBD63000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2353134905.0000026ABBD63000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                    • Avira URL Cloud: safe
                                                                                                                                                    		unknown
                                                                                                                                                    https://google.com/mail1.exe, 00000002.00000003.2995270880.0000026ABBA4C000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2995270880.0000026ABBC23000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3000582627.0000026ABBC53000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2997607005.0000026ABBC52000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2997370247.0000026ABBADF000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2997370247.0000026ABBC23000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                      		high
                                                                                                                                                      http://www.accv.es001.exe, 00000002.00000003.2301140771.0000026ABBDFA000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2306588393.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2301140771.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2277886088.0000026ABBDFA000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2992326469.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2298450794.0000026ABBDFA000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2311139842.0000026ABBDFA000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2999964452.0000026ABBDFA000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2992326469.0000026ABBDFA000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3004069377.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2311139842.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2277886088.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2353134905.0000026ABBDFA000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2353134905.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2306588393.0000026ABBDFA000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                        		high
                                                                                                                                                        https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py1.exe, 00000002.00000003.2158391223.0000026ABA733000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                          		high
                                                                                                                                                          http://www.phys.uu.nl/~vgent/calendar/isocalendar.htm1.exe, 00000002.00000003.2179228653.0000026ABAEFB000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2180761502.0000026ABAEFB000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2178404758.0000026ABAEFB000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                            		high
                                                                                                                                                            http://www.rfc-editor.org/info/rfc72531.exe, 00000002.00000003.2996807987.0000026ABBC89000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2995270880.0000026ABBA4C000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2997370247.0000026ABBADF000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2995270880.0000026ABBC89000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                              		high
                                                                                                                                                              https://www.openssl.org/docs/manmaster/man3/X509_VERIFY_PARAM_set_flags.html1.exe, 00000002.00000003.2994075080.0000026ABCFB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2351404547.0000026ABD00A000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2350870022.0000026ABCFAA000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2352493026.0000026ABCFB1000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                		high
                                                                                                                                                                https://github.com/pyca/cryptography/issues1.exe, 00000000.00000003.2145498424.00000239A9B57000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                  		high
                                                                                                                                                                  http://csrc.nist.gov/publications/nistpubs/800-38C/SP800-38C.pdf1.exe, 00000002.00000003.2995270880.0000026ABBA4C000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3002928468.0000026ABBD35000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2997370247.0000026ABBADF000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3001866849.0000026ABBD2A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                    		high
                                                                                                                                                                    https://readthedocs.org/projects/cryptography/badge/?version=latest1.exe, 00000000.00000003.2145498424.00000239A9B57000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                      		high
                                                                                                                                                                      https://github.com/urllib3/urllib3/issues/2513#issuecomment-1152559900.1.exe, 00000002.00000003.2995270880.0000026ABBA4C000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3000187409.0000026ABBA67000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2998754025.0000026ABBA4C000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                        		high
                                                                                                                                                                        https://packaging.python.org/installing/1.exe, 00000000.00000003.2153965322.00000239A9B54000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                          		high
                                                                                                                                                                          http://google.com/1.exe, 00000002.00000003.2995270880.0000026ABBA14000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2998754025.0000026ABBA14000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                            		high
                                                                                                                                                                            http://crl.securetrust.com/SGCA.crl1.exe, 00000002.00000003.2306588393.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2301140771.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2992326469.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3004069377.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2311139842.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2277886088.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2353134905.0000026ABBDB1000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                              		high
                                                                                                                                                                              http://tools.ietf.org/html/rfc58691.exe, 00000002.00000003.2992893692.0000026ABAF88000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2993635054.0000026ABAF99000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2352647127.0000026ABAF88000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2280798075.0000026ABAF88000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2994800910.0000026ABAFBD000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2301140771.0000026ABBD66000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2306588393.0000026ABBD65000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2310405179.0000026ABAF88000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2994382349.0000026ABAFBB000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2311139842.0000026ABBD66000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2298450794.0000026ABBD66000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2994346572.0000026ABBD63000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2277886088.0000026ABBD63000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2353134905.0000026ABBD63000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                		high
                                                                                                                                                                                https://github.com/psf/black1.exe, 00000000.00000003.2153965322.00000239A9B54000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                  		high
                                                                                                                                                                                  https://github.com/pyca/cryptography1.exe, 00000000.00000003.2145498424.00000239A9B57000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                    		high
                                                                                                                                                                                    http://blog.cryptographyusering.com/2012/05/how-to-choose-authenticated-encryption.html1.exe, 00000002.00000003.2997011920.0000026ABB14E000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2992893692.0000026ABAF88000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2995799183.0000026ABB127000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2993635054.0000026ABAF99000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2352647127.0000026ABAF88000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2353294920.0000026ABB0DE000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2280798075.0000026ABAF88000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2993635054.0000026ABB0DE000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2995270880.0000026ABBA4C000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2280798075.0000026ABB0DE000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2995270880.0000026ABBC23000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3000582627.0000026ABBC53000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2997607005.0000026ABBC52000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2310405179.0000026ABAF88000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2996510516.0000026ABB13F000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3002928468.0000026ABBD35000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2999565146.0000026ABAF9B000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2997370247.0000026ABBADF000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3001866849.0000026ABBD2A000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2997370247.0000026ABBC23000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                      		high
                                                                                                                                                                                      https://cryptography.io/1.exe, 00000000.00000003.2145498424.00000239A9B57000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                        		high
                                                                                                                                                                                        https://httpbin.org/post1.exe, 00000002.00000003.2992893692.0000026ABAF88000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2993635054.0000026ABAF99000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2352647127.0000026ABAF88000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2280798075.0000026ABAF88000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2994800910.0000026ABAFBD000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2310405179.0000026ABAF88000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2994382349.0000026ABAFBB000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                          		high
                                                                                                                                                                                          https://contoso.com/Licensepowershell.exe, 0000001F.00000002.2361908430.0000022081A99000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                                            		high
                                                                                                                                                                                            https://github.com/pyca/cryptography/1.exe, 00000000.00000003.2145498424.00000239A9B57000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                              		high
                                                                                                                                                                                              https://github.com/Ousret/charset_normalizer1.exe, 00000002.00000003.2352647127.0000026ABAECC000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2353294920.0000026ABAED2000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2992893692.0000026ABAECE000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2310405179.0000026ABAED2000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2280798075.0000026ABAED2000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                		high
                                                                                                                                                                                                http://www.firmaprofesional.com/cps01.exe, 00000002.00000003.2301140771.0000026ABBDFA000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2277886088.0000026ABBDFA000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2298450794.0000026ABBDFA000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2311139842.0000026ABBDFA000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2999964452.0000026ABBDFA000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2992326469.0000026ABBDFA000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2353134905.0000026ABBDFA000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2306588393.0000026ABBDFA000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                  		high
                                                                                                                                                                                                  https://tidelift.com/subscription/pkg/pypi-setuptools?utm_source=pypi-setuptools&utm_medium=referral1.exe, 00000000.00000003.2153965322.00000239A9B54000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                  • Avira URL Cloud: safe
                                                                                                                                                                                                  		unknown
                                                                                                                                                                                                  https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=1.exe, 00000002.00000003.2291765845.0000026ABD135000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                    		high
                                                                                                                                                                                                    https://docs.python.org/3/library/re.html#re.sub1.exe, 00000002.00000003.2180036404.0000026ABB0C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2180036404.0000026ABB055000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                      		high

                                                                                                                                                                                                      World Map of Contacted IPs

                                                                                                                                                                                                      • No. of IPs < 25%
                                                                                                                                                                                                      • 25% < No. of IPs < 50%
                                                                                                                                                                                                      • 50% < No. of IPs < 75%
                                                                                                                                                                                                      • 75% < No. of IPs

                                                                                                                                                                                                      Public IPs

                                                                                                                                                                                                      IPDomainCountryFlagASNASN NameMalicious
                                                                                                                                                                                                      208.95.112.1
                                                                                                                                                                                                      		ip-api.comUnited States
                                                                                                                                                                                                      		53334TUT-ASUSfalse
                                                                                                                                                                                                      144.76.136.153
                                                                                                                                                                                                      		transfer.shGermany
                                                                                                                                                                                                      		24940HETZNER-ASDEfalse
                                                                                                                                                                                                      18.66.112.109
                                                                                                                                                                                                      		tiktok.comUnited States
                                                                                                                                                                                                      		3MIT-GATEWAYSUSfalse
                                                                                                                                                                                                      34.117.59.81
                                                                                                                                                                                                      		ipinfo.ioUnited States
                                                                                                                                                                                                      		139070GOOGLE-AS-APGoogleAsiaPacificPteLtdSGfalse
                                                                                                                                                                                                      45.112.123.126
                                                                                                                                                                                                      		api.gofile.ioSingapore
                                                                                                                                                                                                      		16509AMAZON-02USfalse
                                                                                                                                                                                                      151.80.152.246
                                                                                                                                                                                                      		idefasoft.frItaly
                                                                                                                                                                                                      		16276OVHFRfalse

                                                                                                                                                                                                      General Information

                                                                                                                                                                                                      Joe Sandbox version:41.0.0 Charoite
                                                                                                                                                                                                      Analysis ID:1585170
                                                                                                                                                                                                      Start date and time:2025-01-07 08:47:06 +01:00
                                                                                                                                                                                                      Joe Sandbox product:CloudBasic
                                                                                                                                                                                                      Overall analysis duration:0h 9m 9s
                                                                                                                                                                                                      Hypervisor based Inspection enabled:false
                                                                                                                                                                                                      Report type:full
                                                                                                                                                                                                      Cookbook file name:default.jbs
                                                                                                                                                                                                      Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                                                                                                                                                                      Number of analysed new started processes analysed:43
                                                                                                                                                                                                      Number of new started drivers analysed:0
                                                                                                                                                                                                      Number of existing processes analysed:0
                                                                                                                                                                                                      Number of existing drivers analysed:0
                                                                                                                                                                                                      Number of injected processes analysed:0
                                                                                                                                                                                                      Technologies:
                                                                                                                                                                                                      • HCA enabled
                                                                                                                                                                                                      • EGA enabled
                                                                                                                                                                                                      • AMSI enabled
                                                                                                                                                                                                      Analysis Mode:default
                                                                                                                                                                                                      Analysis stop reason:Timeout
                                                                                                                                                                                                      Sample name:1.exe
                                                                                                                                                                                                      Detection:MAL
                                                                                                                                                                                                      Classification:mal96.spyw.evad.winEXE@61/210@6/6
                                                                                                                                                                                                      EGA Information:
                                                                                                                                                                                                      • Successful, ratio: 33.3%
                                                                                                                                                                                                      HCA Information:
                                                                                                                                                                                                      • Successful, ratio: 99%
                                                                                                                                                                                                      • Number of executed functions: 43
                                                                                                                                                                                                      • Number of non-executed functions: 68
                                                                                                                                                                                                      Cookbook Comments:
                                                                                                                                                                                                      • Found application associated with file extension: .exe

                                                                                                                                                                                                      Warnings

                                                                                                                                                                                                      • Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe
                                                                                                                                                                                                      • Excluded IPs from analysis (whitelisted): 13.107.246.45, 20.12.23.50
                                                                                                                                                                                                      • Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
                                                                                                                                                                                                      • Execution Graph export aborted for target powershell.exe, PID 6496 because it is empty
                                                                                                                                                                                                      • Execution Graph export aborted for target powershell.exe, PID 6720 because it is empty
                                                                                                                                                                                                      • Not all processes where analyzed, report is missing behavior information
                                                                                                                                                                                                      • Report size exceeded maximum capacity and may have missing behavior information.
                                                                                                                                                                                                      • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                                                                                                                                                                                      • Report size getting too big, too many NtQueryVolumeInformationFile calls found.
                                                                                                                                                                                                      • Report size getting too big, too many NtSetInformationFile calls found.

                                                                                                                                                                                                      Simulations

                                                                                                                                                                                                      Behavior and APIs

                                                                                                                                                                                                      TimeTypeDescription
                                                                                                                                                                                                      02:48:07API Interceptor7x Sleep call for process: WMIC.exe modified
                                                                                                                                                                                                      02:48:15API Interceptor11x Sleep call for process: powershell.exe modified

                                                                                                                                                                                                      Joe Sandbox View / Context

                                                                                                                                                                                                      IPs

                                                                                                                                                                                                      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                      208.95.112.1YPzNsfg4nR.exeGet hashmaliciousXWormBrowse
                                                                                                                                                                                                      • ip-api.com/line/?fields=hosting
                                                                                                                                                                                                      SAL987656700.exeGet hashmaliciousAgentTeslaBrowse
                                                                                                                                                                                                      • ip-api.com/line/?fields=hosting
                                                                                                                                                                                                      Resource.exeGet hashmaliciousBlank GrabberBrowse
                                                                                                                                                                                                      • ip-api.com/json/?fields=225545
                                                                                                                                                                                                      P3A946MOFP.exeGet hashmaliciousXWormBrowse
                                                                                                                                                                                                      • ip-api.com/line/?fields=hosting
                                                                                                                                                                                                      BootstrapperV1.16.exeGet hashmaliciousXWormBrowse
                                                                                                                                                                                                      • ip-api.com/line/?fields=hosting
                                                                                                                                                                                                      SharkHack.exeGet hashmaliciousXWormBrowse
                                                                                                                                                                                                      • ip-api.com/line/?fields=hosting
                                                                                                                                                                                                      paint.exeGet hashmaliciousBlank GrabberBrowse
                                                                                                                                                                                                      • ip-api.com/json/?fields=225545
                                                                                                                                                                                                      X9g8L63QGs.exeGet hashmaliciousBlank GrabberBrowse
                                                                                                                                                                                                      • ip-api.com/json/?fields=225545
                                                                                                                                                                                                      KpHYfxnJs6.exeGet hashmaliciousBlank GrabberBrowse
                                                                                                                                                                                                      • ip-api.com/json/?fields=225545
                                                                                                                                                                                                      9g9LZNE4bH.exeGet hashmaliciousBlank GrabberBrowse
                                                                                                                                                                                                      • ip-api.com/json/?fields=225545
                                                                                                                                                                                                      144.76.136.153SecuriteInfo.com.Win64.Trojan-gen.31951.26059.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                      • transfer.sh/get/1h9hjM/LoWin64.exe
                                                                                                                                                                                                      SecuriteInfo.com.Win64.Trojan-gen.31951.26059.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                      • transfer.sh/get/1h9hjM/LoWin64.exe
                                                                                                                                                                                                      http://144.76.136.153Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                      • 144.76.136.153:443/
                                                                                                                                                                                                      file.exeGet hashmaliciousRedLineBrowse
                                                                                                                                                                                                      • transfer.sh/get/wADq8n/434123433142.exe
                                                                                                                                                                                                      file.exeGet hashmaliciousRedLineBrowse
                                                                                                                                                                                                      • transfer.sh/get/yAEPpl/gggge.exe
                                                                                                                                                                                                      1JCAVkYU3U.exeGet hashmaliciousRedLineBrowse
                                                                                                                                                                                                      • transfer.sh/get/yAEPpl/gggge.exe
                                                                                                                                                                                                      file.exeGet hashmaliciousRedLine, SmokeLoaderBrowse
                                                                                                                                                                                                      • transfer.sh/get/yAEPpl/gggge.exe
                                                                                                                                                                                                      PURCHASE ORDER & SAMPLE IMAGE.xlsxGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                      • transfer.sh/get/I9BcJI/maxdyn2.1.exe
                                                                                                                                                                                                      RFQ-BT5004423.docGet hashmaliciousAveMaria, UACMeBrowse
                                                                                                                                                                                                      • transfer.sh/get/mGCQGV/gstallabt4.2.exe
                                                                                                                                                                                                      SecuriteInfo.com.Exploit.CVE-2018-0798.4.16955.24932.rtfGet hashmaliciousAveMaria, UACMeBrowse
                                                                                                                                                                                                      • transfer.sh/get/8LtEmv/mwele.exe

                                                                                                                                                                                                      Domains

                                                                                                                                                                                                      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                      ipinfo.ioDownloadedMessage.zipGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                      • 34.117.59.81
                                                                                                                                                                                                      Pralevia Setup 1.0.0.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                      • 34.117.59.81
                                                                                                                                                                                                      Pralevia Setup 1.0.0.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                      • 34.117.59.81
                                                                                                                                                                                                      eP6sjvTqJa.exeGet hashmaliciousDCRat, PureLog Stealer, zgRATBrowse
                                                                                                                                                                                                      • 34.117.59.81
                                                                                                                                                                                                      YGk3y6Tdix.exeGet hashmaliciousDCRat, PureLog Stealer, zgRATBrowse
                                                                                                                                                                                                      • 34.117.59.81
                                                                                                                                                                                                      Etqq32Yuw4.exeGet hashmaliciousDCRat, PureLog Stealer, zgRATBrowse
                                                                                                                                                                                                      • 34.117.59.81
                                                                                                                                                                                                      file.exeGet hashmaliciousLummaC, Amadey, Credential Flusher, LummaC Stealer, StealcBrowse
                                                                                                                                                                                                      • 34.117.59.81
                                                                                                                                                                                                      file.exeGet hashmaliciousLummaC, Amadey, LummaC Stealer, XmrigBrowse
                                                                                                                                                                                                      • 34.117.59.81
                                                                                                                                                                                                      file.exeGet hashmaliciousLummaC, Amadey, LummaC Stealer, XmrigBrowse
                                                                                                                                                                                                      • 34.117.59.81
                                                                                                                                                                                                      58VSNPxrI4.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                      • 34.117.59.81
                                                                                                                                                                                                      ip-api.comYPzNsfg4nR.exeGet hashmaliciousXWormBrowse
                                                                                                                                                                                                      • 208.95.112.1
                                                                                                                                                                                                      SAL987656700.exeGet hashmaliciousAgentTeslaBrowse
                                                                                                                                                                                                      • 208.95.112.1
                                                                                                                                                                                                      Resource.exeGet hashmaliciousBlank GrabberBrowse
                                                                                                                                                                                                      • 208.95.112.1
                                                                                                                                                                                                      P3A946MOFP.exeGet hashmaliciousXWormBrowse
                                                                                                                                                                                                      • 208.95.112.1
                                                                                                                                                                                                      BootstrapperV1.16.exeGet hashmaliciousXWormBrowse
                                                                                                                                                                                                      • 208.95.112.1
                                                                                                                                                                                                      SharkHack.exeGet hashmaliciousXWormBrowse
                                                                                                                                                                                                      • 208.95.112.1
                                                                                                                                                                                                      paint.exeGet hashmaliciousBlank GrabberBrowse
                                                                                                                                                                                                      • 208.95.112.1
                                                                                                                                                                                                      X9g8L63QGs.exeGet hashmaliciousBlank GrabberBrowse
                                                                                                                                                                                                      • 208.95.112.1
                                                                                                                                                                                                      KpHYfxnJs6.exeGet hashmaliciousBlank GrabberBrowse
                                                                                                                                                                                                      • 208.95.112.1
                                                                                                                                                                                                      9g9LZNE4bH.exeGet hashmaliciousBlank GrabberBrowse
                                                                                                                                                                                                      • 208.95.112.1

                                                                                                                                                                                                      ASNs

                                                                                                                                                                                                      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                      HETZNER-ASDEmiori.x86.elfGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                      • 144.79.65.29
                                                                                                                                                                                                      sfqbr.ps1Get hashmaliciousDcRat, KeyLogger, StormKitty, Strela Stealer, VenomRATBrowse
                                                                                                                                                                                                      • 94.130.22.61
                                                                                                                                                                                                      http://yamjoop.siteGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                      • 116.203.80.157
                                                                                                                                                                                                      ZipThis.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                      • 5.161.105.73
                                                                                                                                                                                                      https://tfeweb.co.uk/signoffGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                      • 144.76.9.200
                                                                                                                                                                                                      rHP_SCAN_DOCUME.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                                                      • 136.243.225.5
                                                                                                                                                                                                      https://sendbot.me/mousse-w0fysl7Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                      • 88.198.57.50
                                                                                                                                                                                                      http://www.housepricesintheuk.co.ukGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                      • 178.63.241.79
                                                                                                                                                                                                      getscreen-524501439-x86.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                      • 78.47.165.25
                                                                                                                                                                                                      getscreen-524501439-x86.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                      • 78.47.165.25
                                                                                                                                                                                                      MIT-GATEWAYSUSmiori.x86.elfGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                      • 18.43.155.129
                                                                                                                                                                                                      https://u896278.ct.sendgrid.net/ls/click?upn=u001.qpi-2F0q-2FpcJZ7AGoG9N-2BrxLxoGn8scq-2BedBfmGHFAiwRCk-2Fciku7nsS3YfQMNNJI09mLo_nYx4-2F6dkZkjW10KMIp5mXhxys1ng1sBiI-2Bi9ROMYt6d5xhIh5rIqEUIaIxVHh8-2Ftz-2FouCgfXZk6mMUe2uKm92SOgBLlBdhjnRJuhENZnIuGoEoPqnROi7OCzdabJBBnGjEwd2iK-2BngR2RyIIgM3XrJQ7wQhHrfqScifSW3iAsv3H5nGFK9ntcSdChvkxj0yXdE-2FQ0ICDszl57i6aZSB-2Fow-3D-3DGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                      • 18.66.102.79
                                                                                                                                                                                                      https://report-scam.malwarebouncer.com/XcUR2TnV2VTlXT0s0Z0NYa01KSGt3dUtWMWNiblBrc29mMlpZUU1WdThBSjdDdTlRQTVDV1ZZd0pDeWRmUU5rQ1QvVDNiSlBNYWd2bTd0eTRkZW5jT0hrYTBKWHFiVUc4TVZBOGpiNkh4VG9OTm9zNTVUWHNmNWVydHpqbzhIc1llSzdzTHZ0dENVNWRLZy9BbCsyVDRMSGRHOThUWnV5QUxPU0RZL1dPalNYTmUzMTVoRzl5bmk1ZVZRPT0tLUdVYnJkMC9GazI3MWlxYmotLUpFOURyOWkzK1l6Vy9BYTVOVDBVNkE9PQ==?cid=2346401253Get hashmaliciousKnowBe4Browse
                                                                                                                                                                                                      • 18.173.205.50
                                                                                                                                                                                                      sh4.elfGet hashmaliciousMiraiBrowse
                                                                                                                                                                                                      • 19.44.195.99
                                                                                                                                                                                                      arm4.elfGet hashmaliciousMiraiBrowse
                                                                                                                                                                                                      • 19.240.78.71
                                                                                                                                                                                                      ppc.elfGet hashmaliciousMiraiBrowse
                                                                                                                                                                                                      • 18.66.1.18
                                                                                                                                                                                                      w3245.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                      • 18.173.219.113
                                                                                                                                                                                                      https://app.saner.ai/shared/notes/7353e5ae-dd5f-410b-92c3-210c9e88052aGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                      • 18.66.102.51
                                                                                                                                                                                                      https://u43161309.ct.sendgrid.net/ls/click?upn=u001.L9-2FCbhkaoUACh7As3yZ8i4iABGphfl-2FJgS6Xiu1aw6I-3DgXpA_qO4VbBWAKg4gLfGs-2BfuSyZki3gKzG4I1DrYN15Q8fD7JV1twLeLo1AFs1GBSG3ZgA22dFJdXJloKc56aXDeV3olJKTBJd8NprednZ2LeXdX-2BkcSQE-2F2FRwgBng5RbUCLfjS8-2FI3mrpwyYu9lRatIB62qUwPSax-2Fhh2c7R-2B7pT3Kos0wK0SEJGj4ZMkgOGYhEniKYT7Kn7jN25xFz2sFdtPlVQkIdCFKwDNWmq-2BrAxerZE2GuKgfkuf3l1UY4J42sOOltybAAVyLhV-2BXfmbuQpN4NpshXRIuhta8ho3ChcTA5NtgjludQThyLtwhGns-2ByLqSbpO1Bhhc-2FCgdgP-2BAOxYrGHvKHjVYRr6-2BiryADxfM-3DGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                      • 18.66.102.51
                                                                                                                                                                                                      Vernales Restaurant-encrypted.pdfGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                      • 18.173.205.62
                                                                                                                                                                                                      TUT-ASUSYPzNsfg4nR.exeGet hashmaliciousXWormBrowse
                                                                                                                                                                                                      • 208.95.112.1
                                                                                                                                                                                                      SAL987656700.exeGet hashmaliciousAgentTeslaBrowse
                                                                                                                                                                                                      • 208.95.112.1
                                                                                                                                                                                                      Resource.exeGet hashmaliciousBlank GrabberBrowse
                                                                                                                                                                                                      • 208.95.112.1
                                                                                                                                                                                                      P3A946MOFP.exeGet hashmaliciousXWormBrowse
                                                                                                                                                                                                      • 208.95.112.1
                                                                                                                                                                                                      BootstrapperV1.16.exeGet hashmaliciousXWormBrowse
                                                                                                                                                                                                      • 208.95.112.1
                                                                                                                                                                                                      SharkHack.exeGet hashmaliciousXWormBrowse
                                                                                                                                                                                                      • 208.95.112.1
                                                                                                                                                                                                      paint.exeGet hashmaliciousBlank GrabberBrowse
                                                                                                                                                                                                      • 208.95.112.1
                                                                                                                                                                                                      X9g8L63QGs.exeGet hashmaliciousBlank GrabberBrowse
                                                                                                                                                                                                      • 208.95.112.1
                                                                                                                                                                                                      KpHYfxnJs6.exeGet hashmaliciousBlank GrabberBrowse
                                                                                                                                                                                                      • 208.95.112.1
                                                                                                                                                                                                      9g9LZNE4bH.exeGet hashmaliciousBlank GrabberBrowse
                                                                                                                                                                                                      • 208.95.112.1
                                                                                                                                                                                                      GOOGLE-AS-APGoogleAsiaPacificPteLtdSGhttps://u896278.ct.sendgrid.net/ls/click?upn=u001.qpi-2F0q-2FpcJZ7AGoG9N-2BrxLxoGn8scq-2BedBfmGHFAiwRCk-2Fciku7nsS3YfQMNNJI09mLo_nYx4-2F6dkZkjW10KMIp5mXhxys1ng1sBiI-2Bi9ROMYt6d5xhIh5rIqEUIaIxVHh8-2Ftz-2FouCgfXZk6mMUe2uKm92SOgBLlBdhjnRJuhENZnIuGoEoPqnROi7OCzdabJBBnGjEwd2iK-2BngR2RyIIgM3XrJQ7wQhHrfqScifSW3iAsv3H5nGFK9ntcSdChvkxj0yXdE-2FQ0ICDszl57i6aZSB-2Fow-3D-3DGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                      • 34.117.77.79
                                                                                                                                                                                                      DownloadedMessage.zipGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                      • 34.117.59.81
                                                                                                                                                                                                      http://www.housepricesintheuk.co.ukGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                      • 34.117.239.71
                                                                                                                                                                                                      https://www.scribd.com/document/787929982/script-tlsfranceGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                      • 34.117.239.71
                                                                                                                                                                                                      Pralevia Setup 1.0.0.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                      • 34.117.59.81
                                                                                                                                                                                                      Pralevia Setup 1.0.0.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                      • 34.117.59.81
                                                                                                                                                                                                      http://www.klim.comGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                      • 34.117.77.79
                                                                                                                                                                                                      random.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                                                                                                      • 34.117.188.166
                                                                                                                                                                                                      random.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                                                                                                      • 34.117.188.166
                                                                                                                                                                                                      eP6sjvTqJa.exeGet hashmaliciousDCRat, PureLog Stealer, zgRATBrowse
                                                                                                                                                                                                      • 34.117.59.81

                                                                                                                                                                                                      JA3 Fingerprints

                                                                                                                                                                                                      ⊘No context

                                                                                                                                                                                                      Dropped Files

                                                                                                                                                                                                      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\Cipher\_ARC4.pydvj0Vxt8xM4.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                        vj0Vxt8xM4.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                          snmpapi.exeGet hashmaliciousBraodoBrowse
                                                                                                                                                                                                            snmpapi.exeGet hashmaliciousBraodoBrowse
                                                                                                                                                                                                              54Oa5PcvK1.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                LmZVhGD5jF.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                  zW72x5d91l.batGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                    7EznMik8Fw.exeGet hashmaliciousPython StealerBrowse
                                                                                                                                                                                                                      MkWMm5piE5.exeGet hashmaliciousPython StealerBrowse
                                                                                                                                                                                                                        okG6LaM2yP.exeGet hashmaliciousPython StealerBrowse

                                                                                                                                                                                                                          Created / dropped Files

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):64
                                                                                                                                                                                                                          Entropy (8bit):0.34726597513537405
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:Nlll:Nll
                                                                                                                                                                                                                          MD5:446DD1CF97EABA21CF14D03AEBC79F27
                                                                                                                                                                                                                          SHA1:36E4CC7367E0C7B40F4A8ACE272941EA46373799
                                                                                                                                                                                                                          SHA-256:A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
                                                                                                                                                                                                                          SHA-512:A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:@...e...........................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\AWGADYhKXN.zip

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:Zip archive data, at least v6.3 to extract, compression method=AES Encrypted
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):499784
                                                                                                                                                                                                                          Entropy (8bit):7.9994668849975525
                                                                                                                                                                                                                          Encrypted:true
                                                                                                                                                                                                                          SSDEEP:12288:XwYQBkYgxUGFMPeO9PtuPGr1sY7eVdOitcioKaIS2WD:AYDYgxUG9xGhsY7eVdOiWvIfS
                                                                                                                                                                                                                          MD5:5A033AAAEC17327985290F065EFBDC2F
                                                                                                                                                                                                                          SHA1:781F1373C964D02D4AC564FDA01540294720B804
                                                                                                                                                                                                                          SHA-256:C2F480120AA884294B64E136899DCCF04890BF3019C3EBBA098885F409F5E90A
                                                                                                                                                                                                                          SHA-512:E9E5622F04CF95FB3B7F6363B22A3F195BB240836C752EF08157E914153501D27F7FFC8E3A0B6C6AE577DE545C243E2461BA089347C2548A8F9C0F19BC580BEF
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:PK..?...c...'ZV...............AWGADYhKXN/Data.txt......AE.....?.h.O....B..9.6xxU='...}..}f2lSF..!q.j.@/..s.P...M.G.......O..Zz..:...|..W.|Z=......^Y...j..O.CL?.+..A..S...E.....:......{.^.....I...a.l.Ih....u.?.{r......Q@,ZT.4C.o....:....).......Z...R.o..&.S...G.Gk]~.H.=.......)>Q^rGY....0c...I...>PK..?...c...'Ztd*Ug...n.......AWGADYhKXN/Errors.txt......AE....J.@Y...|.m"P..E....B.......4.....i.M.e|)^bG.hX.....N....Z...EG'.O.<.73....#.n&.C.............t.w_..}?b....9...YL.......(....Q.Dr:..K.BF.m.OW..f..$F..Wk..c...8oyTR....{.Tv.Nf...vuY..:..QT.z...%)3+......v...#\..$S...9.....t\...!.^2...`..L8)K..8....Q.$.c}..X....N...........w.!...t.........{.U..+...._u9.Y,..1....^.c....^'..U6...Iis..t[Q.......4.Q.Eu.Q..D.PZX...v...(.. c.gb...X^S..Xu..y...+..Efl.%IE......2d.D............,.0.\..'.#\|Zz.n....G...:>+.p.8..H..I.-.\?9G.2.*..MO.i..+...yH.....u.u.z'=.Em......`...........8.....M..`rCR.sY.A...|..6.+..u..].............Q@B.C..9.....x?_2.B......&.6..0..n.Xq-..

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\AWGADYhKXN\Data.txt

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):513
                                                                                                                                                                                                                          Entropy (8bit):4.7078249511134915
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:Dn+ZvMarjCvIhJfvLGM67Rb6M4sMwGxtJIW:yZUACvWJr8z4sk5r
                                                                                                                                                                                                                          MD5:6ED0B5E980DC1D1DE00B5CB367F17E78
                                                                                                                                                                                                                          SHA1:BF97A49A4BE458375C61E77F59175C4455DD8E8C
                                                                                                                                                                                                                          SHA-256:D0CE6057780FA505396CF42938034192FF2DEBA4E01551A4B28B678C48C9186C
                                                                                                                                                                                                                          SHA-512:C695823390DDDD64CA0C826B87E10D7487E9C1D5BDF8512AB62D19068A6FCB0B061E0E4032FC082F588B7FC8D6D3C5A5698EBC80A52D3F67A0EDD51C0BE4270E
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.. AWGADYhKXN..... .. Browsers..... .. Data.txt..... .. Directories... ... .. Desktop.txt... ... .. Documents.txt... ... .. Downloads.txt... ... .. Music.txt... ... .. Pictures.txt... ... .. Videos.txt..... .. Errors.txt..... .. System.. ... .. Antivirus.txt.. ... .. Applications.txt.. ... .. screenshot.png.. ... .. Tasklist.txt..3 directories, 12 files

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\AWGADYhKXN\Directories\Desktop.txt

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):2086
                                                                                                                                                                                                                          Entropy (8bit):5.105982542048549
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:e543HGP5RGPnPYtBFl/MuI4t5tvP9CRrAq65Tr720:e0H4ptBFl0uI4tVCWhrx
                                                                                                                                                                                                                          MD5:89F5EC2CE42559D140779A3895342F10
                                                                                                                                                                                                                          SHA1:7CECF0047D53E07840434D07574EACBF8561AD9B
                                                                                                                                                                                                                          SHA-256:870F8B3F819EF6D6988FDF5DA9FB115F8A761A5A3CE7FB92FF81F50657863540
                                                                                                                                                                                                                          SHA-512:7F439F4885496132307802B97018E705587B2128C799DC628DB61686E4E0BFEE98C76E78D49B5D28ED13F78F00672A905B80797D9897EFBC119ABE239412EB75
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.. Desktop..... .. 1.exe..... .. BJZFPPWAPT.mp3..... .. BNAGMGSPLO.jpg..... .. BNAGMGSPLO.mp3..... .. BNAGMGSPLO.pdf..... .. desktop.ini..... .. DUUDTUBZFW.png..... .. EEGWXUHVUG..... .. EFOYFBOLXA..... .. EFOYFBOLXA.jpg..... .. EOWRVPQCCS..... .. EWZCVGNOWT..... .. EWZCVGNOWT.mp3..... .. Excel.lnk..... .. GAOBCVIQIJ.mp3..... .. GAOBCVIQIJ.pdf..... .. GAOBCVIQIJ.xlsx..... .. IPKGELNTQY... ... .. BNAGMGSPLO.mp3... ... .. GAOBCVIQIJ.pdf... ... .. IPKGELNTQY.docx... ... .. LSBIHQFDVT.xlsx... ... .. QCFWYSKMHA.jpg... ... .. SUAVTZKNFL.png..... .. IPKGELNTQY.docx..... .. IPKGELNTQY.xlsx..... .. JDDHMPCDUJ..... .. LSBIHQFDVT... ... .. BNAGMGSPLO.pdf... ... .. DUUDTUBZFW.png... ... .. EFOYFBOLXA.jpg... ..

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\AWGADYhKXN\Directories\Documents.txt

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):2370
                                                                                                                                                                                                                          Entropy (8bit):5.121017886850444
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:6543HGP5RGPTtBFl/MuI4t5tE3r3M3O3q3yP9CRrAq65Tr7p:60H4KtBFl0uI4t+D+0YuCWhr1
                                                                                                                                                                                                                          MD5:9782C47FD28D8F7BB5A4072471664CAC
                                                                                                                                                                                                                          SHA1:FC9E102FC051FFA6C8FF53D183639B3D07C91500
                                                                                                                                                                                                                          SHA-256:4A6D4CE2CF047AD892F5CB36EB47D9FB379D4BA057D68E6BA75E883986046096
                                                                                                                                                                                                                          SHA-512:41058A89FD2F983751E944C3F7436E70A5B894ABB84EE27EF2D0923F4209947E6F580BDE385DC173DFEDD3934A2D09FEB068F1CEF51BCD20DEC02B55E60EDB36
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.. Documents..... .. BJZFPPWAPT.mp3..... .. BNAGMGSPLO.jpg..... .. BNAGMGSPLO.mp3..... .. BNAGMGSPLO.pdf..... .. desktop.ini..... .. DUUDTUBZFW.png..... .. EEGWXUHVUG..... .. EFOYFBOLXA..... .. EFOYFBOLXA.jpg..... .. EOWRVPQCCS..... .. EWZCVGNOWT..... .. EWZCVGNOWT.mp3..... .. GAOBCVIQIJ.mp3..... .. GAOBCVIQIJ.pdf..... .. GAOBCVIQIJ.xlsx..... .. IPKGELNTQY... ... .. BNAGMGSPLO.mp3... ... .. GAOBCVIQIJ.pdf... ... .. IPKGELNTQY.docx... ... .. LSBIHQFDVT.xlsx... ... .. QCFWYSKMHA.jpg... ... .. SUAVTZKNFL.png..... .. IPKGELNTQY.docx..... .. IPKGELNTQY.xlsx..... .. JDDHMPCDUJ..... .. LSBIHQFDVT... ... .. BNAGMGSPLO.pdf... ... .. DUUDTUBZFW.png... ... .. EFOYFBOLXA.jpg... ... .. EWZCVGNOWT.mp3... ... ..

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\AWGADYhKXN\Directories\Downloads.txt

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):819
                                                                                                                                                                                                                          Entropy (8bit):5.247131562314812
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12:YBgx539LK3gjGrHIdx5zIm4G3Yv5nUx5tgV6VWg7fQ+xx5lqRXdQF:f543mGU5ztB3Yv5o5tgV6V5D5lqROF
                                                                                                                                                                                                                          MD5:F0B7C718304311D45F2389AC0FA1C470
                                                                                                                                                                                                                          SHA1:B6A5B9E941A784206FB717FCC5A4D62822F3439C
                                                                                                                                                                                                                          SHA-256:8DE8EFE9AA6E421F83A703D8C1B9D66EA5C89253834E08666A90E0DE652B1632
                                                                                                                                                                                                                          SHA-512:FC5CF1524D4BA98E592719FC1B1C4D140D9CC36FC9E096E21789137C0763603E53EFCD409D5449D294094E011994FBF4130F6A7D2C75D9FC4C29BBC87EDEE8DD
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.. Downloads..... .. BJZFPPWAPT.mp3..... .. BNAGMGSPLO.jpg..... .. BNAGMGSPLO.mp3..... .. BNAGMGSPLO.pdf..... .. desktop.ini..... .. DUUDTUBZFW.png..... .. EFOYFBOLXA.jpg..... .. EWZCVGNOWT.mp3..... .. GAOBCVIQIJ.mp3..... .. GAOBCVIQIJ.pdf..... .. GAOBCVIQIJ.xlsx..... .. IPKGELNTQY.docx..... .. IPKGELNTQY.xlsx..... .. LSBIHQFDVT.docx..... .. LSBIHQFDVT.jpg..... .. LSBIHQFDVT.xlsx..... .. NEBFQQYWPS.docx..... .. NEBFQQYWPS.pdf..... .. NVWZAPQSQL.png..... .. PWCCAWLGRE.pdf..... .. QCFWYSKMHA.jpg..... .. QCFWYSKMHA.xlsx..... .. SFPUSAFIOL.docx..... .. SUAVTZKNFL.png..... .. ZQIXMVQGAH.png..0 directories, 25 files

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\AWGADYhKXN\Directories\Music.txt

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):62
                                                                                                                                                                                                                          Entropy (8bit):4.635253769889823
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:j2BvFMKVLKfHGSWLcQJAWn:czLKfHGJhzn
                                                                                                                                                                                                                          MD5:F107B808B2E7C55E5008BAB67244757F
                                                                                                                                                                                                                          SHA1:D7C0258B99BEC149DCECF5507ECC869ABBF357E0
                                                                                                                                                                                                                          SHA-256:B4CD998A662F9DFE027FF44451A450B30E46EAFE272371438E8B7471A4A0D8AF
                                                                                                                                                                                                                          SHA-512:5471C7F1538982AFCBD0FD4F61AB1E732D1C15B937E423A00D708ADE2A8038F9339967B1EC92328E44DFED068529A9835CE54E9EFE65E60C04E385A675AD1B97
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.. Music..... .. desktop.ini..0 directories, 1 files

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\AWGADYhKXN\Directories\Pictures.txt

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):190
                                                                                                                                                                                                                          Entropy (8bit):4.677340340590718
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:j1GbT57EIVqUdxHjDFMKVLK3F5MKVLK3pFrEwH5/HjDFMKVLKItSWLCD0n:Rg/VqUXLK39LK3ZFLKItJA0n
                                                                                                                                                                                                                          MD5:792AF172414F1B170389E233E78D417A
                                                                                                                                                                                                                          SHA1:81554A6E3F9729E155A85608C839BF413A16087C
                                                                                                                                                                                                                          SHA-256:456F70E6C843A1C8A9255CF299EE6E10D2B1321E410B43F1243308F9942E6C7B
                                                                                                                                                                                                                          SHA-512:FE66F8EF6AAA8B53E61AAA4C1B817F244766D440C9B30B566BB0829A096C3EB7357A03DC513795354C97193903C48253BA56D23E7B5019968F5DE0834C47B5BC
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.. Pictures..... .. Camera Roll... ... .. desktop.ini..... .. desktop.ini..... .. Saved Pictures.. ... .. desktop.ini..2 directories, 3 files

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\AWGADYhKXN\Directories\Videos.txt

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):63
                                                                                                                                                                                                                          Entropy (8bit):4.566266383982755
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:jpvWUfFMKVLKfHGSWLcQJAWn:JzLKfHGJhzn
                                                                                                                                                                                                                          MD5:D13AE2C4D9B07B177B9E37AA08524491
                                                                                                                                                                                                                          SHA1:3B851A1EFEE0912A9D76FE3D9AA7DC1DEB457055
                                                                                                                                                                                                                          SHA-256:D6B7B4FF5334036BBDDBA2C76B1602ABE3BA0D40244886F39D3F7AF1EE16D34B
                                                                                                                                                                                                                          SHA-512:C9FE282DB71DC69E31ED72F6BDFA7D6894CE49174F56D78DD02A43715F9960C434D94CED3AE9ED8312D4007C28745E0D7F6BC809928F2BB48501D9B3E6C60710
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.. Videos..... .. desktop.ini..0 directories, 1 files

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\AWGADYhKXN\Errors.txt

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):2926
                                                                                                                                                                                                                          Entropy (8bit):5.172607975089228
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:bWLsO87Etb4XFPnY6pnYXVO9HBtrKkBspA+DoaHBtc:bsBCgb4XnpiOVKkBJ+Dod
                                                                                                                                                                                                                          MD5:16A92F8138C664C8D8DEB41703C0FFD4
                                                                                                                                                                                                                          SHA1:C7B00D51EFAD34CFD1A9E705D519D8214FF9D67A
                                                                                                                                                                                                                          SHA-256:189F610DCEDA0A290069D69384A426FFA2FBC0608FA89F3D1583D90139D791BB
                                                                                                                                                                                                                          SHA-512:CF503AB44D9CA7E9F41BF709D2B97831C58220C371B2F9274847A1AD7DE155E0F7EC4C2233A8346B62223D430A86DF11C35999EF6932739051E1FD45A945C9BF
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:....==================================================....Traceback (most recent call last):.. File "utils.py", line 22, in new_func.. File "main.py", line 195, in steal_browser_data.. File "browsers.py", line 267, in write_files..FileNotFoundError: [Errno 2] No such file or directory: 'C:\\Users\\user\\AppData\\Local\\Temp\\AWGADYhKXN\\Browsers\\Chrome\\cookies.json'......==================================================....Traceback (most recent call last):.. File "urllib3\connectionpool.py", line 466, in _make_request.. File "urllib3\connectionpool.py", line 1095, in _validate_conn.. File "urllib3\connection.py", line 652, in connect.. File "urllib3\connection.py", line 805, in _ssl_wrap_socket_and_match_hostname.. File "urllib3\util\ssl_.py", line 465, in ssl_wrap_socket.. File "urllib3\util\ssl_.py", line 509, in _ssl_wrap_socket_impl.. File "ssl.py", line 517, in wrap_socket.. File "ssl.py", line 1108, in _create.. File "ssl.py", line 1379, in do_handshake..ssl.S

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\AWGADYhKXN\System\Antivirus.txt

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):16
                                                                                                                                                                                                                          Entropy (8bit):3.452819531114783
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:jBJiA7X:jBJiA7X
                                                                                                                                                                                                                          MD5:01DAEFE4CAF17BE6854E1A9A0DECE70C
                                                                                                                                                                                                                          SHA1:FEE51C1AB6684F18E59F3FFA9C0296ED1E5DBD28
                                                                                                                                                                                                                          SHA-256:2331BE85A81C008DEDBFEF3BFB0D68EF76AC6BEE37CF9E653591790A21DBBF32
                                                                                                                                                                                                                          SHA-512:AA934777ECB3097CD820EDED81C9C7BAF68039A7E448CEC067317565427212882301BA517ADFB5F63A6677E7D80BAF15837F05DC8C9A9D2BD80F3CA65234ED16
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:Windows Defender

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\AWGADYhKXN\System\Applications.txt

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):876
                                                                                                                                                                                                                          Entropy (8bit):5.2166841219061775
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:7o2WJotgHeJpA4VrPUNU27PUCdd2lbPUups2liJ79g:7o2W+weJ+MPY3PxdsbPhpJiJ79g
                                                                                                                                                                                                                          MD5:6E856172BA7718035C1C662A71EEB266
                                                                                                                                                                                                                          SHA1:033C57899736A1C3B83E58CC87F46CEE0C31D4A2
                                                                                                                                                                                                                          SHA-256:7E0B70742BE964B0AC9BC6D70B31BC267AD36E49FD3C3EB860F68C7E613EE8DC
                                                                                                                                                                                                                          SHA-512:08495D1FFA2E23E1731A02681375204DDA1B89ABD9EBCBF2323912FF3D9E2503F1D3B21A726386E9DCD1246C3393FC1C6EA78E296781ABCC04A17B2994DFFD66
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:7-Zip 23.01 (x64) (23.01)..Adobe Acrobat (64-bit) (23.006.20320)..Google Chrome (117.0.5938.134)..Java 8 Update 381 (8.0.3810.9)..Java Auto Updater (2.8.381.9)..Microsoft Edge (117.0.2045.55)..Microsoft Edge Update (1.3.177.11)..Microsoft Edge WebView2 Runtime (117.0.2045.47)..Microsoft Office Professional Plus 2019 - en-us (16.0.16827.20130)..Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.36.32532 (14.36.32532.0)..Microsoft Visual C++ 2022 X64 Additional Runtime - 14.36.32532 (14.36.32532)..Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.36.32532 (14.36.32532)..Mozilla Firefox (x64 en-US) (118.0.1)..Mozilla Maintenance Service (118.0.1)..Office 16 Click-to-Run Extensibility Component (16.0.16827.20130)..Office 16 Click-to-Run Extensibility Component 64-bit Registration (16.0.16827.20056)..Office 16 Click-to-Run Licensing Component (16.0.16827.20130)

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\AWGADYhKXN\System\Tasklist.txt

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):15832
                                                                                                                                                                                                                          Entropy (8bit):3.5128629032055088
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:yziAuPdTg3UMb3rEj5+d6XYhdqtfNgxSYdVYrGm5Cs+2Mt++a9wPTPXu4oTYOmVx:yziAuPdTg3UMb3rEj5+d6XYhdqtfNgxF
                                                                                                                                                                                                                          MD5:DCD77731249EEC9121A78EB5C596FC6D
                                                                                                                                                                                                                          SHA1:C08D086B5467A2403E94FE8860003442E72C78BC
                                                                                                                                                                                                                          SHA-256:3E3E2A9905EF4D1B80EEB2475B9CB9F68722C3996CD5120B7FFBD2A6D93420C4
                                                                                                                                                                                                                          SHA-512:6579D16543F8424CEEDEBAD81F05852A4FC1AB5D76E190EB97E64A4CC6D965B2E2EBDC0A5A3166152A8EAE7EF37CBFDAB2E63D361C0F61F37C4EBBC95F832EF3
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:1.exe 2304 Console 1 88'296 K..1.exe 5968 Console 1 5'944 K..========================= ======== ================ =========== ============..ApplicationFrameHost.exe 5400 Console 1 26'332 K..BMpJSdhynVOLWgkMioS.exe 712 Console 1 6'340 K..BMpJSdhynVOLWgkMioS.exe 876 Console 1 6'344 K..BMpJSdhynVOLWgkMioS.exe 1020 Console 1 6'340 K..BMpJSdhynVOLWgkMioS.exe 1220 Console 1 6'340 K..BMpJSdhynVOLWgkMioS.exe 1476 Console 1 6'340 K..BMpJSdhynVOLWgkMioS.exe 1616 Console 1 6'332 K..BMpJSdhynVOLWgkMioS.exe 1808 Console 1 6'332 K..BMpJSdhynVOLWgkMioS.exe 1832 Console 1 6'348 K..BMpJSdhynVOLWgkMioS.exe 1908 Console 1

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\AWGADYhKXN\System\screenshot.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:PNG image data, 1280 x 1024, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):489761
                                                                                                                                                                                                                          Entropy (8bit):7.993917789683895
                                                                                                                                                                                                                          Encrypted:true
                                                                                                                                                                                                                          SSDEEP:12288:MAetlilnPpr+WWMmU60tg+4e2HudzPU7kc9JRzp9mwyg6pr5BAkfP:1H++602exPY9Gg2r5yyP
                                                                                                                                                                                                                          MD5:CF0A3523E5DA327CCA52BEE12A16A4BD
                                                                                                                                                                                                                          SHA1:E62B81789474E9A1F7B08CD761E3071E0419F7A6
                                                                                                                                                                                                                          SHA-256:926D3B1ECAF9CA793F458EAB7F0F55304D25D5289D93C9C823F78F60D052728E
                                                                                                                                                                                                                          SHA-512:7E59757C316761283DA438D7A9D22A9E82CA33208822CAB4529B89FF3A4A3F83431F0F0DE64B4B005A763293D1562F23C3829343C4AE02BFCE98EFCAD60C26B4
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR.............1.c.....IDATx..{.^Eu7.]..sN.I.9....$(QTnj.....Z.(VEk.._.`[..J.Vm..bo...Pk-.*.....^...H..D!.*..I8..y....k.z...s...Y.sx...Y.f...;k.....b..KW.t..."...u..K..2U.....4..r.X...q.........J...B".q.S.k..<]~\.....!.M.9.=r....;-9wa...d..,E:..N...N..v.....,...V.3.&.%A.(.L..s..8..e.5......M}..W.g..~Nwh.|..G....3.;.....rQ_.z..\y..%...4.;e*;h.0s.%.z(.........R..X&.TM.sO...k/.."..j.R6....s.zo...{nG.s.I...7_3.....j..H...O..Y. .i.....e...9...|...*O..:.rN......3..m.r...l.D....4M...>I...mKzGD..WT..uyt..T.tO.(H...`..^afm]..@d(B.!...pK.R...Q/....V.V\".v....o7..$.,..4.I.?*Ra.9.Y.......i...9.4.s2..V..}..jI[..T..Z....Z..0.rSaRIU.C..v...'M......~....q.E&(._. ..,.2a.NR.p..L"U'.P...L.[..i.{...y....,..W4k.9'..%.I(.P..h4.4..Ig.G.....F..9.."..<U.i....}q..<M..u]:..?..<.E}..P....".9.aRe....R..9..9"b...#.UZ..c...G.if.&-<. C...`.mN...l7K.g) .l..VPd.z...........N.|^..@M..=.++).. ......C.H.<XI.0*..g.mWo.<.(B...sT.5(..#+XQ..6... \...Zm.X..RJ.....

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\Cipher\_ARC4.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):11264
                                                                                                                                                                                                                          Entropy (8bit):4.703513333396807
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:nDzb9VD9daQ2iTrqT+6Zdp/Q0I1uLfcC75JiC4Rs89EcYyGDV90OcX6gY/7ECFV:Dzz9damqTrpYTst0E5DVPcqgY/79X
                                                                                                                                                                                                                          MD5:6176101B7C377A32C01AE3EDB7FD4DE6
                                                                                                                                                                                                                          SHA1:5F1CB443F9D677F313BEC07C5241AEAB57502F5E
                                                                                                                                                                                                                          SHA-256:EFEA361311923189ECBE3240111EFBA329752D30457E0DBE9628A82905CD4BDB
                                                                                                                                                                                                                          SHA-512:3E7373B71AE0834E96A99595CFEF2E96C0F5230429ADC0B5512F4089D1ED0D7F7F0E32A40584DFB13C41D257712A9C4E9722366F0A21B907798AE79D8CEDCF30
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Joe Sandbox View:
                                                                                                                                                                                                                          • Filename: vj0Vxt8xM4.exe, Detection: malicious, Browse
                                                                                                                                                                                                                          • Filename: vj0Vxt8xM4.exe, Detection: malicious, Browse
                                                                                                                                                                                                                          • Filename: snmpapi.exe, Detection: malicious, Browse
                                                                                                                                                                                                                          • Filename: snmpapi.exe, Detection: malicious, Browse
                                                                                                                                                                                                                          • Filename: 54Oa5PcvK1.exe, Detection: malicious, Browse
                                                                                                                                                                                                                          • Filename: LmZVhGD5jF.exe, Detection: malicious, Browse
                                                                                                                                                                                                                          • Filename: zW72x5d91l.bat, Detection: malicious, Browse
                                                                                                                                                                                                                          • Filename: 7EznMik8Fw.exe, Detection: malicious, Browse
                                                                                                                                                                                                                          • Filename: MkWMm5piE5.exe, Detection: malicious, Browse
                                                                                                                                                                                                                          • Filename: okG6LaM2yP.exe, Detection: malicious, Browse
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........K...*b..*b..*b..R...*b..Uc..*b.Rc..*b..*c..*b..Ug..*b..Uf..*b..Ua..*b..j..*b..b..*b....*b..`..*b.Rich.*b.................PE..d....e.........." ...%............P........................................p............`.........................................P(.......(..d....P.......@...............`..,...."...............................!..@............ ...............................text............................... ..`.rdata..,.... ......................@..@.data...8....0......."..............@....pdata.......@.......$..............@..@.rsrc........P.......(..............@..@.reloc..,....`.......*..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\Cipher\_Salsa20.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):13312
                                                                                                                                                                                                                          Entropy (8bit):4.968452734961967
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:JF3TgNlF/1Nt5aSd4+1ijg0NLfFNJSCqsstXHTeH5ht47qMbxbfDqbwYH/kcX6gT:WF/1nb2mhQtkXHTeZ87VDqrMcqgYvEp
                                                                                                                                                                                                                          MD5:371776A7E26BAEB3F75C93A8364C9AE0
                                                                                                                                                                                                                          SHA1:BF60B2177171BA1C6B4351E6178529D4B082BDA9
                                                                                                                                                                                                                          SHA-256:15257E96D1CA8480B8CB98F4C79B6E365FE38A1BA9638FC8C9AB7FFEA79C4762
                                                                                                                                                                                                                          SHA-512:C23548FBCD1713C4D8348917FF2AB623C404FB0E9566AB93D147C62E06F51E63BDAA347F2D203FE4F046CE49943B38E3E9FA1433F6455C97379F2BC641AE7CE9
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d....e.........." ...%............P.....................................................`..........................................8......x9..d....`.......P..L............p..,....3...............................1..@............0...............................text...(........................... ..`.rdata.......0......................@..@.data...8....@.......*..............@....pdata..L....P.......,..............@..@.rsrc........`.......0..............@..@.reloc..,....p.......2..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\Cipher\_chacha20.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):13824
                                                                                                                                                                                                                          Entropy (8bit):5.061461040216793
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:ldF/1nb2mhQtkXn0t/WS60YYDEiqvdvGyv9lkVcqgYvEMo:v2f6XSZ6XYD6vdvGyv9MgYvEMo
                                                                                                                                                                                                                          MD5:CB5238E2D4149636377F9A1E2AF6DC57
                                                                                                                                                                                                                          SHA1:038253BABC9E652BA4A20116886209E2BCCF35AC
                                                                                                                                                                                                                          SHA-256:A8D3BB9CD6A78EBDB4F18693E68B659080D08CB537F9630D279EC9F26772EFC7
                                                                                                                                                                                                                          SHA-512:B1E6AB509CF1E5ECC6A60455D6900A76514F8DF43F3ABC3B8D36AF59A3DF8A868B489ED0B145D0D799AAC8672CBF5827C503F383D3F38069ABF6056ECCD87B21
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d....e.........." ...%............P.....................................................`..........................................8.......9..d....`.......P..d............p..,....2...............................1..@............0...............................text............................... ..`.rdata.......0......................@..@.data...8....@.......,..............@....pdata..d....P......................@..@.rsrc........`.......2..............@..@.reloc..,....p.......4..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\Cipher\_pkcs1_decode.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):13824
                                                                                                                                                                                                                          Entropy (8bit):5.236167046748013
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:/siHXqpoUol3xZhRyQX5lDnRDFYav+tcqgRvE:h6D+XBDgDgRvE
                                                                                                                                                                                                                          MD5:D9E7218460AEE693BEA07DA7C2B40177
                                                                                                                                                                                                                          SHA1:9264D749748D8C98D35B27BEFE6247DA23FF103D
                                                                                                                                                                                                                          SHA-256:38E423D3BCC32EE6730941B19B7D5D8872C0D30D3DD8F9AAE1442CB052C599AD
                                                                                                                                                                                                                          SHA-512:DDB579E2DEA9D266254C0D9E23038274D9AE33F0756419FD53EC6DC1A27D1540828EE8F4AD421A5CFFD9B805F1A68F26E70BDC1BAB69834E8ACD6D7BB7BDB0DB
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........K..*...*...*...R...*...U...*..R...*...*...*...U...*...U...*...U...*.....*.....*...}..*.....*..Rich.*..........................PE..d....e.........." ...%............P.....................................................`..........................................9.......9..d....`.......P..|............p..,....3...............................1..@............0...............................text............................... ..`.rdata.......0......................@..@.data...h....@.......,..............@....pdata..|....P......................@..@.rsrc........`.......2..............@..@.reloc..,....p.......4..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\Cipher\_raw_aes.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):36352
                                                                                                                                                                                                                          Entropy (8bit):6.558176937399355
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:Dz2P+7nYpPMedFDlDchrVX1mEVmT9ZgkoD/PKDkGuF0U390QOo8VdbKBWmuCLg46:DzeqWB7YJlmLJ3oD/S4j990th9VCsC
                                                                                                                                                                                                                          MD5:F751792DF10CDEED391D361E82DAF596
                                                                                                                                                                                                                          SHA1:3440738AF3C88A4255506B55A673398838B4CEAC
                                                                                                                                                                                                                          SHA-256:9524D1DADCD2F2B0190C1B8EDE8E5199706F3D6C19D3FB005809ED4FEBF3E8B5
                                                                                                                                                                                                                          SHA-512:6159F245418AB7AD897B02F1AADF1079608E533B9C75006EFAF24717917EAA159846EE5DFC0E85C6CFF8810319EFECBA80C1D51D1F115F00EC1AFF253E312C00
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........K...*b..*b..*b..R...*b..Uc..*b.Rc..*b..*c..*b..Ug..*b..Uf..*b..Ua..*b..j..*b..b..*b....*b..`..*b.Rich.*b.................PE..d....e.........." ...%.H...H......P.....................................................`.................................................,...d...............................4... ...................................@............`...............................text....F.......H.................. ..`.rdata..d6...`...8...L..............@..@.data...8...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..4...........................@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\Cipher\_raw_aesni.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):15872
                                                                                                                                                                                                                          Entropy (8bit):5.285191078037458
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:wJBjJHEkEPYi3Xd+dc26E4++yuqAyXW9wifD4jqccqgwYUMvEW:ikRwi3wO26Ef+yuIm9PfD7wgwYUMvE
                                                                                                                                                                                                                          MD5:BBEA5FFAE18BF0B5679D5C5BCD762D5A
                                                                                                                                                                                                                          SHA1:D7C2721795113370377A1C60E5CEF393473F0CC5
                                                                                                                                                                                                                          SHA-256:1F4288A098DA3AAC2ADD54E83C8C9F2041EC895263F20576417A92E1E5B421C1
                                                                                                                                                                                                                          SHA-512:0932EC5E69696D6DD559C30C19FC5A481BEFA38539013B9541D84499F2B6834A2FFE64A1008A1724E456FF15DDA6268B7B0AD8BA14918E2333567277B3716CC4
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........TX..:...:...:.....:..;...:...;...:...;...:..?...:..>...:..9...:..R2...:..R:...:..R....:..R8...:.Rich..:.................PE..d....e.........." ...%. ... ......P.....................................................`..........................................9......D:..d....`.......P...............p..,....3...............................1..@............0.. ............................text...h........ .................. ..`.rdata.......0.......$..............@..@.data...(....@.......4..............@....pdata.......P.......6..............@..@.rsrc........`.......:..............@..@.reloc..,....p.......<..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\Cipher\_raw_arc2.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):16384
                                                                                                                                                                                                                          Entropy (8bit):5.505471888568532
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:vd9VkyQ5f8vjVaCHpKpTTjaNe7oca2DW3Q2dhmdcqgwNeecBih:JkP5cjIGpKlqD2D4kzgwNeE
                                                                                                                                                                                                                          MD5:D2175300E065347D13211F5BF7581602
                                                                                                                                                                                                                          SHA1:3AE92C0B0ECDA1F6B240096A4E68D16D3DB1FFB0
                                                                                                                                                                                                                          SHA-256:94556934E3F9EE73C77552D2F3FC369C02D62A4C9E7143E472F8E3EE8C00AEE1
                                                                                                                                                                                                                          SHA-512:6156D744800206A431DEE418A1C561FFB45D726DC75467A91D26EE98503B280C6595CDEA02BDA6A023235BD010835EA1FC9CB843E9FEC3501980B47B6B490AF7
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d....e.........." ...%."... ......P.....................................................`.........................................0J.......J..d....p.......`..................,....C...............................B..@............@...............................text....!.......".................. ..`.rdata.......@.......&..............@..@.data...8....P.......6..............@....pdata.......`.......8..............@..@.rsrc........p.......<..............@..@.reloc..,............>..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\Cipher\_raw_blowfish.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):20992
                                                                                                                                                                                                                          Entropy (8bit):6.06124024160806
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:bUv5cJMOZA0nmwBD+XpJgLa0Mp8Qpg4P2llyM:0K1XBD+DgLa1yTi
                                                                                                                                                                                                                          MD5:45616B10ABE82D5BB18B9C3AB446E113
                                                                                                                                                                                                                          SHA1:91B2C0B0F690AE3ABFD9B0B92A9EA6167049B818
                                                                                                                                                                                                                          SHA-256:F348DB1843B8F38A23AEE09DD52FB50D3771361C0D529C9C9E142A251CC1D1EC
                                                                                                                                                                                                                          SHA-512:ACEA8C1A3A1FA19034FD913C8BE93D5E273B7719D76CB71C36F510042918EA1D9B44AC84D849570F9508D635B4829D3E10C36A461EC63825BA178F5AC1DE85FB
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d....e.........." ...%.$...0......P.....................................................`.........................................pY.......Z..d............p..................4...@S...............................R..@............@...............................text....".......$.................. ..`.rdata..L....@... ...(..............@..@.data...8....`.......H..............@....pdata.......p.......J..............@..@.rsrc................N..............@..@.reloc..4............P..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\Cipher\_raw_cast.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):25088
                                                                                                                                                                                                                          Entropy (8bit):6.475467273446457
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:oc6HLZiMDFuGu+XHZXmrfXA+UA10ol31tuXy4IYgLWi:B6H1TZXX5XmrXA+NNxWiFdLWi
                                                                                                                                                                                                                          MD5:CF3C2F35C37AA066FA06113839C8A857
                                                                                                                                                                                                                          SHA1:39F3B0AEFB771D871A93681B780DA3BD85A6EDD0
                                                                                                                                                                                                                          SHA-256:1261783F8881642C3466B96FA5879A492EA9E0DAB41284ED9E4A82E8BCF00C80
                                                                                                                                                                                                                          SHA-512:1C36B80AAE49FD5E826E95D83297AE153FDB2BC652A47D853DF31449E99D5C29F42ED82671E2996AF60DCFB862EC5536BB0A68635D4E33D33F8901711C0C8BE6
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d....e.........." ...%.$...@............................................................`.........................................@i.......i..d...............................4....b...............................a..@............@...............................text....#.......$.................. ..`.rdata.......@...0...(..............@..@.data...8....p.......X..............@....pdata...............Z..............@..@.rsrc................^..............@..@.reloc..4............`..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\Cipher\_raw_cbc.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):12288
                                                                                                                                                                                                                          Entropy (8bit):4.838534302892255
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:0F/1nb2mhQtkr+juOxKbDbnHcqgYvEkrK:u2f6iuOsbDtgYvEmK
                                                                                                                                                                                                                          MD5:20708935FDD89B3EDDEEA27D4D0EA52A
                                                                                                                                                                                                                          SHA1:85A9FE2C7C5D97FD02B47327E431D88A1DC865F7
                                                                                                                                                                                                                          SHA-256:11DD1B49F70DB23617E84E08E709D4A9C86759D911A24EBDDFB91C414CC7F375
                                                                                                                                                                                                                          SHA-512:F28C31B425DC38B5E9AD87B95E8071997E4A6F444608E57867016178CD0CA3E9F73A4B7F2A0A704E45F75B7DCFF54490510C6BF8461F3261F676E9294506D09B
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d....e.........." ...%............P.....................................................`..........................................8.......9..d....`.......P..X............p..,....2...............................1..@............0...............................text............................... ..`.rdata.......0......................@..@.data...8....@.......&..............@....pdata..X....P.......(..............@..@.rsrc........`.......,..............@..@.reloc..,....p......................@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\Cipher\_raw_cfb.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):13824
                                                                                                                                                                                                                          Entropy (8bit):4.9047185025862925
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:NRgPX8lvI+KnwSDTPUDEhKWPXcqgzQkvEd:2og9rUD9mpgzQkvE
                                                                                                                                                                                                                          MD5:43BBE5D04460BD5847000804234321A6
                                                                                                                                                                                                                          SHA1:3CAE8C4982BBD73AF26EB8C6413671425828DBB7
                                                                                                                                                                                                                          SHA-256:FAA41385D0DB8D4EE2EE74EE540BC879CF2E884BEE87655FF3C89C8C517EED45
                                                                                                                                                                                                                          SHA-512:DBC60F1D11D63BEBBAB3C742FB827EFBDE6DFF3C563AE1703892D5643D5906751DB3815B97CBFB7DA5FCD306017E4A1CDCC0CDD0E61ADF20E0816F9C88FE2C9B
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........K...*...*...*...RQ..*...U...*..R...*...*...*...U...*...U...*...U...*......*......*...=..*......*..Rich.*..................PE..d....e.........." ...%..... ......P.....................................................`..........................................9.......9..d....`.......P..d............p..,....3...............................1..@............0...............................text...(........................... ..`.rdata.......0......................@..@.data...8....@.......,..............@....pdata..d....P......................@..@.rsrc........`.......2..............@..@.reloc..,....p.......4..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\Cipher\_raw_ctr.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):14848
                                                                                                                                                                                                                          Entropy (8bit):5.300163691206422
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:j0J1gSHxKkwv0i8XSi3Sm57NEEE/qexUEtDrdkrRcqgUF6+6vEX:jM01si8XSi3SACqe7tDeDgUUjvE
                                                                                                                                                                                                                          MD5:C6B20332B4814799E643BADFFD8DF2CD
                                                                                                                                                                                                                          SHA1:E7DA1C1F09F6EC9A84AF0AB0616AFEA55A58E984
                                                                                                                                                                                                                          SHA-256:61C7A532E108F67874EF2E17244358DF19158F6142680F5B21032BA4889AC5D8
                                                                                                                                                                                                                          SHA-512:D50C7F67D2DFB268AD4CF18E16159604B6E8A50EA4F0C9137E26619FD7835FAAD323B5F6A2B8E3EC1C023E0678BCBE5D0F867CD711C5CD405BD207212228B2B4
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........K,..*B..*B..*B..R...*B..UC..*B.RC..*B..*C..*B..UG..*B..UF..*B..UA..*B..J..*B..B..*B....*B..@..*B.Rich.*B.........................PE..d....e.........." ...%..... ......P.....................................................`..........................................9......x:..d....`.......P...............p..,....3...............................1..@............0.. ............................text............................... ..`.rdata.......0....... ..............@..@.data........@.......0..............@....pdata.......P.......2..............@..@.rsrc........`.......6..............@..@.reloc..,....p.......8..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\Cipher\_raw_des.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):57856
                                                                                                                                                                                                                          Entropy (8bit):4.260220483695234
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:9XUqVT1dZ/GHkJnYcZiGKdZHDLtiduprZNZY0JAIg+v:99HGHfJidSK
                                                                                                                                                                                                                          MD5:0B538205388FDD99A043EE3AFAA074E4
                                                                                                                                                                                                                          SHA1:E0DD9306F1DBE78F7F45A94834783E7E886EB70F
                                                                                                                                                                                                                          SHA-256:C4769D3E6EB2A2FECB5DEC602D45D3E785C63BB96297268E3ED069CC4A019B1A
                                                                                                                                                                                                                          SHA-512:2F4109E42DB7BC72EB50BCCC21EB200095312EA00763A255A38A4E35A77C04607E1DB7BB69A11E1D80532767B20BAA4860C05F52F32BF1C81FE61A7ECCEB35ED
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........A.........................................................K......K......Ki.....K.....Rich...........................PE..d....e.........." ...%.8...................................................0............`.....................................................d...............l............ ..4...................................@...@............P...............................text....7.......8.................. ..`.rdata..f....P.......<..............@..@.data...8...........................@....pdata..l...........................@..@.rsrc...............................@..@.reloc..4.... ......................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\Cipher\_raw_des3.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):58368
                                                                                                                                                                                                                          Entropy (8bit):4.276870967324261
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:9jUqho9weF5/eHkRnYcZiGKdZHDL7idErZjZYXGg:9RCneH//id42
                                                                                                                                                                                                                          MD5:6C3E976AB9F47825A5BD9F73E8DBA74E
                                                                                                                                                                                                                          SHA1:4C6EB447FE8F195CF7F4B594CE7EAF928F52B23A
                                                                                                                                                                                                                          SHA-256:238CDB6B8FB611DB4626E6D202E125E2C174C8F73AE8A3273B45A0FC18DEA70C
                                                                                                                                                                                                                          SHA-512:B19516F00CC0484D9CDA82A482BBFE41635CDBBE19C13F1E63F033C9A68DD36798C44F04D6BD8BAE6523A845E852D81ACADD0D5DD86AF62CC9D081B803F8DF7B
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........A.........................................................K......K......Ki.....K.....Rich...........................PE..d....e.........." ...%.:...................................................0............`.................................................P...d............................ ..4...................................@...@............P...............................text...x9.......:.................. ..`.rdata.......P.......>..............@..@.data...8...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..4.... ......................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\Cipher\_raw_ecb.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):10752
                                                                                                                                                                                                                          Entropy (8bit):4.578113904149635
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:R0qVVdJvbrqTu6ZdpvY0IluLfcC75JiCKs89EpmFWLOXDwo2Pj15XkcX6gbW6z:DVddiT7pgTctEEI4qXDo11kcqgbW6
                                                                                                                                                                                                                          MD5:FEE13D4FB947835DBB62ACA7EAFF44EF
                                                                                                                                                                                                                          SHA1:7CC088AB68F90C563D1FE22D5E3C3F9E414EFC04
                                                                                                                                                                                                                          SHA-256:3E0D07BBF93E0748B42B1C2550F48F0D81597486038C22548224584AE178A543
                                                                                                                                                                                                                          SHA-512:DEA92F935BC710DF6866E89CC6EB5B53FC7ADF0F14F3D381B89D7869590A1B0B1F98F347664F7A19C6078E7AA3EB0F773FFCB711CC4275D0ECD54030D6CF5CB2
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6...r.`.r.`.r.`.{...p.`.g.a.p.`.9.a.q.`.r.a.Q.`.g.e.y.`.g.d.z.`.g.c.q.`.H.h.s.`.H.`.s.`.H...s.`.H.b.s.`.Richr.`.................PE..d....e.........." ...%............P........................................p............`.........................................p'......((..P....P.......@...............`..,...."...............................!..@............ ...............................text............................... ..`.rdata....... ......................@..@.data...8....0......."..............@....pdata.......@.......$..............@..@.rsrc........P.......&..............@..@.reloc..,....`.......(..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\Cipher\_raw_eksblowfish.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):22016
                                                                                                                                                                                                                          Entropy (8bit):6.143719741413071
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:IUv5cRUtPQtjLJiKMjNrDF6pJgLa0Mp8Q90gYP2lXCM:BKR8I+K0lDFQgLa17zU
                                                                                                                                                                                                                          MD5:76F88D89643B0E622263AF676A65A8B4
                                                                                                                                                                                                                          SHA1:93A365060E98890E06D5C2D61EFBAD12F5D02E06
                                                                                                                                                                                                                          SHA-256:605C86145B3018A5E751C6D61FD0F85CF4A9EBF2AD1F3009A4E68CF9F1A63E49
                                                                                                                                                                                                                          SHA-512:979B97AAC01633C46C048010FA886EBB09CFDB5520E415F698616987AE850FD342A4210A8DC0FAC1E059599F253565862892171403F5E4F83754D02D2EF3F366
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d....e.........." ...%.(...0......P.....................................................`.........................................pY.......Z..d............p..................4...@S...............................R..@............@...............................text...X'.......(.................. ..`.rdata..T....@... ...,..............@..@.data...8....`.......L..............@....pdata.......p.......N..............@..@.rsrc................R..............@..@.reloc..4............T..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\Cipher\_raw_ocb.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):17920
                                                                                                                                                                                                                          Entropy (8bit):5.353267174592179
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:7PHNP3Mj7Be/yB/6sB3yxcb+IMcOYqQViCBD8bg6Vf4A:hPcnB8KSsB34cb+bcOYpMCBDX
                                                                                                                                                                                                                          MD5:D48BFFA1AF800F6969CFB356D3F75AA6
                                                                                                                                                                                                                          SHA1:2A0D8968D74EBC879A17045EFE86C7FB5C54AEE6
                                                                                                                                                                                                                          SHA-256:4AA5E9CE7A76B301766D3ECBB06D2E42C2F09D0743605A91BF83069FEFE3A4DE
                                                                                                                                                                                                                          SHA-512:30D14AD8C68B043CC49EAFB460B69E83A15900CB68B4E0CBB379FF5BA260194965EF300EB715308E7211A743FF07FA7F8779E174368DCAA7F704E43068CC4858
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d....e.........." ...%.(... ......P.....................................................`..........................................I.......J..d....p.......`..................,....C...............................A..@............@...............................text....'.......(.................. ..`.rdata..8....@.......,..............@..@.data........P.......<..............@....pdata.......`.......>..............@..@.rsrc........p.......B..............@..@.reloc..,............D..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\Cipher\_raw_ofb.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):12288
                                                                                                                                                                                                                          Entropy (8bit):4.741247880746506
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:0F/1nb2mhQtkgU7L9D037tfcqgYvEJPb:u2f6L9DSJxgYvEJj
                                                                                                                                                                                                                          MD5:4D9182783EF19411EBD9F1F864A2EF2F
                                                                                                                                                                                                                          SHA1:DDC9F878B88E7B51B5F68A3F99A0857E362B0361
                                                                                                                                                                                                                          SHA-256:C9F4C5FFCDD4F8814F8C07CE532A164AB699AE8CDE737DF02D6ECD7B5DD52DBD
                                                                                                                                                                                                                          SHA-512:8F983984F0594C2CAC447E9D75B86D6EC08ED1C789958AFA835B0D1239FD4D7EBE16408D080E7FCE17C379954609A93FC730B11BE6F4A024E7D13D042B27F185
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d....e.........." ...%............P.....................................................`..........................................8.......9..d....`.......P..X............p..,....2...............................1..@............0...............................text............................... ..`.rdata.......0......................@..@.data...8....@.......&..............@....pdata..X....P.......(..............@..@.rsrc........`.......,..............@..@.reloc..,....p......................@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\Hash\_BLAKE2b.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):14848
                                                                                                                                                                                                                          Entropy (8bit):5.212941287344097
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:2F/1nb2mhQtkRySMfJ2ycxFzShJD9bAal2QDeJKcqgQx2QY:M2fKRQB2j8JD2fJagQx2QY
                                                                                                                                                                                                                          MD5:F4EDB3207E27D5F1ACBBB45AAFCB6D02
                                                                                                                                                                                                                          SHA1:8EAB478CA441B8AD7130881B16E5FAD0B119D3F0
                                                                                                                                                                                                                          SHA-256:3274F49BE39A996C5E5D27376F46A1039B6333665BB88AF1CA6D37550FA27B29
                                                                                                                                                                                                                          SHA-512:7BDEBF9829CB26C010FCE1C69E7580191084BCDA3E2847581D0238AF1CAA87E68D44B052424FDC447434D971BB481047F8F2DA1B1DEF6B18684E79E63C6FBDC5
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d....e.........." ...%..... ......P.....................................................`..........................................9......|:..d....`.......P..@............p..,....3...............................2..@............0...............................text...X........................... ..`.rdata.......0....... ..............@..@.data...8....@.......0..............@....pdata..@....P.......2..............@..@.rsrc........`.......6..............@..@.reloc..,....p.......8..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\Hash\_BLAKE2s.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):14336
                                                                                                                                                                                                                          Entropy (8bit):5.181291194389683
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:hF/1nb2mhQt7fSOp/CJPvADQHKtxSOvbcqgEvcM+:N2fNKOZWPIDnxVlgEvL
                                                                                                                                                                                                                          MD5:9D28433EA8FFBFE0C2870FEDA025F519
                                                                                                                                                                                                                          SHA1:4CC5CF74114D67934D346BB39CA76F01F7ACC3E2
                                                                                                                                                                                                                          SHA-256:FC296145AE46A11C472F99C5BE317E77C840C2430FBB955CE3F913408A046284
                                                                                                                                                                                                                          SHA-512:66B4D00100D4143EA72A3F603FB193AFA6FD4EFB5A74D0D17A206B5EF825E4CC5AF175F5FB5C40C022BDE676BA7A83087CB95C9F57E701CA4E7F0A2FCE76E599
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d....e.........." ...%..... ......P.....................................................`.........................................09.......9..d....`.......P..@............p..,....3...............................2..@............0...............................text...8........................... ..`.rdata..4....0......................@..@.data...8....@......................@....pdata..@....P.......0..............@..@.rsrc........`.......4..............@..@.reloc..,....p.......6..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\Hash\_MD2.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):14336
                                                                                                                                                                                                                          Entropy (8bit):5.140195114409974
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:RsiHXqpo0cUp8XnUp8XjEQnlDtJI6rcqgcx2:f6DcUp8XUp8AclDA69gcx2
                                                                                                                                                                                                                          MD5:8A92EE2B0D15FFDCBEB7F275154E9286
                                                                                                                                                                                                                          SHA1:FA9214C8BBF76A00777DFE177398B5F52C3D972D
                                                                                                                                                                                                                          SHA-256:8326AE6AD197B5586222AFA581DF5FE0220A86A875A5E116CB3828E785FBF5C2
                                                                                                                                                                                                                          SHA-512:7BA71C37AAF6CB10FC5C595D957EB2846032543626DE740B50D7CB954FF910DCF7CEAA56EB161BAB9CC1F663BADA6CA71973E6570BAC7D6DA4D4CC9ED7C6C3DA
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d....e.........." ...%..... ......P.....................................................`..........................................9......0:..d....`.......P..(............p..,....4...............................2..@............0...............................text............................... ..`.rdata.......0......................@..@.data...h....@......................@....pdata..(....P.......0..............@..@.rsrc........`.......4..............@..@.reloc..,....p.......6..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\Hash\_MD4.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):13824
                                                                                                                                                                                                                          Entropy (8bit):5.203867759982304
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:WsiHXqpwUiv6wPf+4WVrd1DFrCqwWwcqgfvE:s6biio2Pd1DFmlgfvE
                                                                                                                                                                                                                          MD5:FE16E1D12CF400448E1BE3FCF2D7BB46
                                                                                                                                                                                                                          SHA1:81D9F7A2C6540F17E11EFE3920481919965461BA
                                                                                                                                                                                                                          SHA-256:ADE1735800D9E82B787482CCDB0FBFBA949E1751C2005DCAE43B0C9046FE096F
                                                                                                                                                                                                                          SHA-512:A0463FF822796A6C6FF3ACEBC4C5F7BA28E7A81E06A3C3E46A0882F536D656D3F8BAF6FB748008E27F255FE0F61E85257626010543FC8A45A1E380206E48F07C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d....e.........." ...%............P.....................................................`.........................................p8...... 9..d....`.......P..(............p..,...@3...............................2..@............0...............................text...X........................... ..`.rdata..p....0......................@..@.data...p....@.......,..............@....pdata..(....P......................@..@.rsrc........`.......2..............@..@.reloc..,....p.......4..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\Hash\_MD5.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):15360
                                                                                                                                                                                                                          Entropy (8bit):5.478301937972917
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:hZ9WXA7M93g8U7soSchhiLdjM5J6ECTGmDZkRsP0rcqgjPrvE:8Q0gH7zSccA5J6ECTGmDua89gjPrvE
                                                                                                                                                                                                                          MD5:34EBB5D4A90B5A39C5E1D87F61AE96CB
                                                                                                                                                                                                                          SHA1:25EE80CC1E647209F658AEBA5841F11F86F23C4E
                                                                                                                                                                                                                          SHA-256:4FC70CB9280E414855DA2C7E0573096404031987C24CF60822854EAA3757C593
                                                                                                                                                                                                                          SHA-512:82E27044FD53A7309ABAECA06C077A43EB075ADF1EF0898609F3D9F42396E0A1FA4FFD5A64D944705BBC1B1EBB8C2055D8A420807693CC5B70E88AB292DF81B7
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d....e.........." ...%. ..........P.....................................................`..........................................8.......9..d....`.......P..X............p..,....3...............................1..@............0...............................text............ .................. ..`.rdata.......0.......$..............@..@.data........@.......2..............@....pdata..X....P.......4..............@..@.rsrc........`.......8..............@..@.reloc..,....p.......:..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\Hash\_RIPEMD160.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):18432
                                                                                                                                                                                                                          Entropy (8bit):5.69608744353984
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:nkP5RjF7GsIyV6Lx41NVYaVmtShQRKAa8+DSngkov:onx7RI26LuuHKz8+DbN
                                                                                                                                                                                                                          MD5:42C2F4F520BA48779BD9D4B33CD586B9
                                                                                                                                                                                                                          SHA1:9A1D6FFA30DCA5CE6D70EAC5014739E21A99F6D8
                                                                                                                                                                                                                          SHA-256:2C6867E88C5D3A83D62692D24F29624063FCE57F600483BAD6A84684FF22F035
                                                                                                                                                                                                                          SHA-512:1F0C18E1829A5BAE4A40C92BA7F8422D5FE8DBE582F7193ACEC4556B4E0593C898956065F398ACB34014542FCB3365DC6D4DA9CE15CB7C292C8A2F55FB48BB2B
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d....e.........." ...%.*... ......P.....................................................`..........................................I.......J..d....p.......`..................,....D..............................PC..@............@...............................text....).......*.................. ..`.rdata.......@......................@..@.data...8....P.......>..............@....pdata.......`.......@..............@..@.rsrc........p.......D..............@..@.reloc..,............F..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\Hash\_SHA1.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):19456
                                                                                                                                                                                                                          Entropy (8bit):5.7981108922569735
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:qPHNP3MjevhSY/8EBbVxcJ0ihTLdFDuPHgj+kf4D:sPcKvr/jUJ0sbDGAj+t
                                                                                                                                                                                                                          MD5:AB0BCB36419EA87D827E770A080364F6
                                                                                                                                                                                                                          SHA1:6D398F48338FB017AACD00AE188606EB9E99E830
                                                                                                                                                                                                                          SHA-256:A927548ABEA335E6BCB4A9EE0A949749C9E4AA8F8AAD481CF63E3AC99B25A725
                                                                                                                                                                                                                          SHA-512:3580FB949ACEE709836C36688457908C43860E68A36D3410F3FA9E17C6A66C1CDD7C081102468E4E92E5F42A0A802470E8F4D376DAA4ED7126818538E0BD0BC4
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d....e.........." ...%.0..........P.....................................................`..........................................H.......I..d....p.......`..X...............,....C...............................A..@............@...............................text..../.......0.................. ..`.rdata.......@.......4..............@..@.data........P.......B..............@....pdata..X....`.......D..............@..@.rsrc........p.......H..............@..@.reloc..,............J..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\Hash\_SHA224.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):22016
                                                                                                                                                                                                                          Entropy (8bit):5.865452719694432
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:y1jwGPJHLvzcY1EEerju9LcTZ6RO3RouLKtcyDNOcwgjxo:QjwyJUYToZwOLuzDNB1j
                                                                                                                                                                                                                          MD5:C8FE3FF9C116DB211361FBB3EA092D33
                                                                                                                                                                                                                          SHA1:180253462DD59C5132FBCCC8428DEA1980720D26
                                                                                                                                                                                                                          SHA-256:25771E53CFECB5462C0D4F05F7CAE6A513A6843DB2D798D6937E39BA4B260765
                                                                                                                                                                                                                          SHA-512:16826BF93C8FA33E0B5A2B088FB8852A2460E0A02D699922A39D8EB2A086E981B5ACA2B085F7A7DA21906017C81F4D196B425978A10F44402C5DB44B2BF4D00A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d....e.........." ...%.8... ......P.....................................................`..........................................Z.......[..d............p..................,... T...............................R..@............P...............................text....6.......8.................. ..`.rdata.......P.......<..............@..@.data........`.......L..............@....pdata.......p.......N..............@..@.rsrc................R..............@..@.reloc..,............T..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\Hash\_SHA256.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):22016
                                                                                                                                                                                                                          Entropy (8bit):5.867732744112887
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:51jwGPJHLxzcY1EEerju9LcTZ6RO3RouLKtcyDNIegjxo:rjwyJOYToZwOLuzDNI7j
                                                                                                                                                                                                                          MD5:A442EA85E6F9627501D947BE3C48A9DD
                                                                                                                                                                                                                          SHA1:D2DEC6E1BE3B221E8D4910546AD84FE7C88A524D
                                                                                                                                                                                                                          SHA-256:3DBCB4D0070BE355E0406E6B6C3E4CE58647F06E8650E1AB056E1D538B52B3D3
                                                                                                                                                                                                                          SHA-512:850A00C7069FFDBA1EFE1324405DA747D7BD3BA5D4E724D08A2450B5A5F15A69A0D3EAF67CEF943F624D52A4E2159A9F7BDAEAFDC6C689EACEA9987414250F3B
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d....e.........." ...%.8... ......P.....................................................`..........................................Z.......[..d............p..................,... T...............................R..@............P...............................text....6.......8.................. ..`.rdata.......P.......<..............@..@.data........`.......L..............@....pdata.......p.......N..............@..@.rsrc................R..............@..@.reloc..,............T..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\Hash\_SHA384.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):27136
                                                                                                                                                                                                                          Entropy (8bit):5.860044313282322
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:xFDL3RqE3MjjQ95UnLa+1WT1aA7qHofg5JptfISH2mDDXfgjVx2:jDLh98jjRe+1WT1aAeIfMzxH2mDDIj
                                                                                                                                                                                                                          MD5:59BA0E05BE85F48688316EE4936421EA
                                                                                                                                                                                                                          SHA1:1198893F5916E42143C0B0F85872338E4BE2DA06
                                                                                                                                                                                                                          SHA-256:C181F30332F87FEECBF930538E5BDBCA09089A2833E8A088C3B9F3304B864968
                                                                                                                                                                                                                          SHA-512:D772042D35248D25DB70324476021FB4303EF8A0F61C66E7DED490735A1CC367C2A05D7A4B11A2A68D7C34427971F96FF7658D880E946C31C17008B769E3B12F
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d....e.........." ...%.J..."......P.....................................................`......................................... l.......m..d...............................,....e...............................d..@............`...............................text...hH.......J.................. ..`.rdata..X....`.......N..............@..@.data................`..............@....pdata...............b..............@..@.rsrc................f..............@..@.reloc..,............h..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\Hash\_SHA512.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):27136
                                                                                                                                                                                                                          Entropy (8bit):5.917025846093607
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:tFYLXRqEnMgj969GUnLa+1WT1aA7qHofg5JptfIS320DXwElrgjhig:PYLB9Mgj0e+1WT1aAeIfMzx320DXD+j
                                                                                                                                                                                                                          MD5:8194D160FB215498A59F850DC5C9964C
                                                                                                                                                                                                                          SHA1:D255E8CCBCE663EE5CFD3E1C35548D93BFBBFCC0
                                                                                                                                                                                                                          SHA-256:55DEFCD528207D4006D54B656FD4798977BD1AAE6103D4D082A11E0EB6900B08
                                                                                                                                                                                                                          SHA-512:969EEAA754519A58C352C24841852CF0E66C8A1ADBA9A50F6F659DC48C3000627503DDFB7522DA2DA48C301E439892DE9188BF94EEAF1AE211742E48204C5E42
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d....e.........." ...%.J..."......P.....................................................`..........................................l.......m..d...............................,...@f...............................e..@............`...............................text....H.......J.................. ..`.rdata.......`.......N..............@..@.data................`..............@....pdata...............b..............@..@.rsrc................f..............@..@.reloc..,............h..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\Hash\_ghash_clmul.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):12800
                                                                                                                                                                                                                          Entropy (8bit):4.999870226643325
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:DzFRF/1nb2mhQtk4axusjfkgZhoYDQgRjcqgQvEty:DzFd2f64axnTTz5D1gQvEty
                                                                                                                                                                                                                          MD5:C89BECC2BECD40934FE78FCC0D74D941
                                                                                                                                                                                                                          SHA1:D04680DF546E2D8A86F60F022544DB181F409C50
                                                                                                                                                                                                                          SHA-256:E5B6E58D6DA8DB36B0673539F0C65C80B071A925D2246C42C54E9FCDD8CA08E3
                                                                                                                                                                                                                          SHA-512:715B3F69933841BAADC1C30D616DB34E6959FD9257D65E31C39CD08C53AFA5653B0E87B41DCC3C5E73E57387A1E7E72C0A668578BD42D5561F4105055F02993C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........K...*b..*b..*b..R...*b..Uc..*b.Rc..*b..*c..*b..Ug..*b..Uf..*b..Ua..*b..j..*b..b..*b....*b..`..*b.Rich.*b.................PE..d....e.........." ...%............P.....................................................`..........................................8......89..d....`.......P...............p..,....3...............................1..@............0...............................text............................... ..`.rdata.......0......................@..@.data...8....@.......(..............@....pdata.......P.......*..............@..@.rsrc........`......................@..@.reloc..,....p.......0..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\Hash\_ghash_portable.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):13312
                                                                                                                                                                                                                          Entropy (8bit):5.025153056783597
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:AF/1nb2mhQtks0iiNqdF4mtPjD02A5APYcqgYvEL2x:62f6fFA/4GjDFcgYvEL2x
                                                                                                                                                                                                                          MD5:C4CC05D3132FDFB05089F42364FC74D2
                                                                                                                                                                                                                          SHA1:DA7A1AE5D93839577BBD25952A1672C831BC4F29
                                                                                                                                                                                                                          SHA-256:8F3D92DE840ABB5A46015A8FF618FF411C73009CBAA448AC268A5C619CF84721
                                                                                                                                                                                                                          SHA-512:C597C70B7AF8E77BEEEBF10C32B34C37F25C741991581D67CF22E0778F262E463C0F64AA37F92FBC4415FE675673F3F92544E109E5032E488F185F1CFBC839FE
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d....e.........." ...%............P.....................................................`..........................................8......h9..d....`.......P..X............p..,....2...............................1..@............0...............................text............................... ..`.rdata.......0......................@..@.data...8....@.......*..............@....pdata..X....P.......,..............@..@.rsrc........`.......0..............@..@.reloc..,....p.......2..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\Hash\_keccak.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):16384
                                                                                                                                                                                                                          Entropy (8bit):5.235115741550938
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:XTRgffnRaNfBj9xih1LPK73jm6AXiN4rSRIh42gDhgvrjcqgCieT3WQ:XafgNpj9cHW3jqXeBRamDOZgCieT
                                                                                                                                                                                                                          MD5:1E201DF4B4C8A8CD9DA1514C6C21D1C4
                                                                                                                                                                                                                          SHA1:3DC8A9C20313AF189A3FFA51A2EAA1599586E1B2
                                                                                                                                                                                                                          SHA-256:A428372185B72C90BE61AC45224133C4AF6AE6682C590B9A3968A757C0ABD6B4
                                                                                                                                                                                                                          SHA-512:19232771D4EE3011938BA2A52FA8C32E00402055038B5EDF3DDB4C8691FA7AE751A1DC16766D777A41981B7C27B14E9C1AD6EBDA7FFE1B390205D0110546EE29
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d....e.........." ...%."... ......P.....................................................`.........................................`I......TJ..d....p.......`..p...............,....C...............................B..@............@...............................text...(!.......".................. ..`.rdata.......@.......&..............@..@.data........P.......6..............@....pdata..p....`.......8..............@..@.rsrc........p.......<..............@..@.reloc..,............>..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\Hash\_poly1305.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):15360
                                                                                                                                                                                                                          Entropy (8bit):5.133714807569085
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:JZNGXEgvUh43G6coX2SSwmPL4V7wTdDlpaY2cqgWjvE:EVMhuGGF2L4STdDyYWgWjvE
                                                                                                                                                                                                                          MD5:76C84B62982843367C5F5D41B550825F
                                                                                                                                                                                                                          SHA1:B6DE9B9BD0E2C84398EA89365E9F6D744836E03A
                                                                                                                                                                                                                          SHA-256:EBCD946F1C432F93F396498A05BF07CC77EE8A74CE9C1A283BF9E23CA8618A4C
                                                                                                                                                                                                                          SHA-512:03F8BB1D0D63BF26D8A6FFF62E94B85FFB4EA1857EB216A4DEB71C806CDE107BA0F9CC7017E3779489C5CEF5F0838EDB1D70F710BCDEB629364FC288794E6AFE
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d....e.........." ...%..... ......P.....................................................`......................................... 9.......9..d....`.......P..|............p..,....3...............................1..@............0...............................text...X........................... ..`.rdata..(....0......."..............@..@.data........@.......2..............@....pdata..|....P.......4..............@..@.rsrc........`.......8..............@..@.reloc..,....p.......:..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\Math\_modexp.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):35840
                                                                                                                                                                                                                          Entropy (8bit):5.928082706906375
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:8bEkzS7+k9rMUb8cOe9rs9ja+V/Mhjh56GS:8bEP779rMtcOCs0I/Mhf
                                                                                                                                                                                                                          MD5:B41160CF884B9E846B890E0645730834
                                                                                                                                                                                                                          SHA1:A0F35613839A0F8F4A87506CD59200CCC3C09237
                                                                                                                                                                                                                          SHA-256:48F296CCACE3878DE1148074510BD8D554A120CAFEF2D52C847E05EF7664FFC6
                                                                                                                                                                                                                          SHA-512:F4D57351A627DD379D56C80DA035195292264F49DC94E597AA6638DF5F4CF69601F72CC64FC3C29C5CBE95D72326395C5C6F4938B7895C69A8D839654CFC8F26
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......N4.|.U./.U./.U./.-a/.U./.*...U./A-...U./.U./!U./.*...U./.*...U./.*...U./0....U./0....U./0../.U./0....U./Rich.U./................PE..d......e.........." ...%.^...0......`.....................................................`..........................................~..|...\...d...............................,....s...............................q..@............p..(............................text...8].......^.................. ..`.rdata.......p.......b..............@..@.data................v..............@....pdata..............................@..@.rsrc...............................@..@.reloc..,...........................@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\Protocol\_scrypt.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):12288
                                                                                                                                                                                                                          Entropy (8bit):4.799063285091512
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:nkCfXASTMeAk4OepIXcADp/X6RcqgO5vE:ZJMcPepIXcAD563gO5vE
                                                                                                                                                                                                                          MD5:BA46602B59FCF8B01ABB135F1534D618
                                                                                                                                                                                                                          SHA1:EFF5608E05639A17B08DCA5F9317E138BEF347B5
                                                                                                                                                                                                                          SHA-256:B1BAB0E04AC60D1E7917621B03A8C72D1ED1F0251334E9FA12A8A1AC1F516529
                                                                                                                                                                                                                          SHA-512:A5E2771623DA697D8EA2E3212FBDDE4E19B4A12982A689D42B351B244EFBA7EFA158E2ED1A2B5BC426A6F143E7DB810BA5542017AB09B5912B3ECC091F705C6E
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........K...*...*...*...RQ..*...U...*..R...*...*...*...U...*...U...*...U...*......*......*...=..*......*..Rich.*..................PE..d....e.........." ...%............P.....................................................`..........................................8..d...$9..d....`.......P..4............p..,....3...............................1..@............0...............................text...x........................... ..`.rdata.......0......................@..@.data........@.......&..............@....pdata..4....P.......(..............@..@.rsrc........`.......,..............@..@.reloc..,....p......................@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\PublicKey\_ec_ws.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):754688
                                                                                                                                                                                                                          Entropy (8bit):7.624959985050181
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:I1UrmZ9HoxJ8gf1266y8IXhJvCKAmqVLzcrZgYIMGv1iLD9yQvG6h9:gYmzHoxJFf1p34hcrn5Go9yQO6L
                                                                                                                                                                                                                          MD5:3F20627FDED2CF90E366B48EDF031178
                                                                                                                                                                                                                          SHA1:00CED7CD274EFB217975457906625B1B1DA9EBDF
                                                                                                                                                                                                                          SHA-256:E36242855879D71AC57FBD42BB4AE29C6D80B056F57B18CEE0B6B1C0E8D2CF57
                                                                                                                                                                                                                          SHA-512:05DE7C74592B925BB6D37528FC59452C152E0DCFC1D390EA1C48C057403A419E5BE40330B2C5D5657FEA91E05F6B96470DDDF9D84FF05B9FD4192F73D460093C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......&:..b[.Lb[.Lb[.Lk#sLd[.Lw$.M`[.L)#.Ma[.Lb[.LI[.Lw$.Mn[.Lw$.Mj[.Lw$.Ma[.LX..Mg[.LX..Mc[.LX..Lc[.LX..Mc[.LRichb[.L........................PE..d....e.........." ...%.n..........`.....................................................`..........................................p..d...tq..d...............0...............4...@Z...............................Y..@...............(............................text....l.......n.................. ..`.rdata...............r..............@..@.data................j..............@....pdata..0............r..............@..@.rsrc...............................@..@.reloc..4...........................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\PublicKey\_ed25519.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):27648
                                                                                                                                                                                                                          Entropy (8bit):5.792654050660321
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:hBwi/rOF26VZW1n0n/Is42g9qhrnW0mvPauYhz35sWJftjb1Ddsia15gkbQ0e1:/L/g28Ufsxg9GmvPauYLxtX1D/kf
                                                                                                                                                                                                                          MD5:290D936C1E0544B6EC98F031C8C2E9A3
                                                                                                                                                                                                                          SHA1:CAEEA607F2D9352DD605B6A5B13A0C0CB1EA26EC
                                                                                                                                                                                                                          SHA-256:8B00C859E36CBCE3EC19F18FA35E3A29B79DE54DA6030AAAD220AD766EDCDF0A
                                                                                                                                                                                                                          SHA-512:F08B67B633D3A3F57F1183950390A35BF73B384855EAAB3AE895101FBC07BCC4990886F8DE657635AD528D6C861BC2793999857472A5307FFAA963AA6685D7E8
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..........)......................................R......R......RE.....R.....Rich...........PE..d....e.........." ...%.F...(......P.....................................................`..........................................j..0....k..d...............................,...pc..............................0b..@............`...............................text...xD.......F.................. ..`.rdata.."....`.......J..............@..@.data................\..............@....pdata...............d..............@..@.rsrc................h..............@..@.reloc..,............j..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\PublicKey\_ed448.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):67072
                                                                                                                                                                                                                          Entropy (8bit):6.060461288575063
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:1536:nqctkGACFI5t35q2JbL0UbkrwwOoKXyMH1B7M9rMdccdWxRLpq:nqctkGACFI5t35q2JbgrwwOoqLTM9rMh
                                                                                                                                                                                                                          MD5:5782081B2A6F0A3C6B200869B89C7F7D
                                                                                                                                                                                                                          SHA1:0D4E113FB52FE1923FE05CDF2AB9A4A9ABEFC42E
                                                                                                                                                                                                                          SHA-256:E72E06C721DD617140EDEBADD866A91CF97F7215CBB732ECBEEA42C208931F49
                                                                                                                                                                                                                          SHA-512:F7FD695E093EDE26FCFD0EE45ADB49D841538EB9DAAE5B0812F29F0C942FB13762E352C2255F5DB8911F10FA1B6749755B51AAE1C43D8DF06F1D10DE5E603706
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......N4.|.U./.U./.U./.-a/.U./.*...U./A-...U./.U./!U./.*...U./.*...U./.*...U./0....U./0....U./0../.U./0....U./Rich.U./................PE..d......e.........." ...%.....8......`........................................@............`.........................................`...h.......d.... .......................0..,.......................................@............................................text............................... ..`.rdata..*...........................@..@.data...............................@....pdata..............................@..@.rsrc........ ......................@..@.reloc..,....0......................@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\PublicKey\_x25519.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):10752
                                                                                                                                                                                                                          Entropy (8bit):4.488437566846231
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:tpVVdJvbrqTu6ZdpvY0IluLfcC75JiC4cs89EfqADwhDTAbcX6gn/7EC:5VddiT7pgTctdErDwDTicqgn/7
                                                                                                                                                                                                                          MD5:289EBF8B1A4F3A12614CFA1399250D3A
                                                                                                                                                                                                                          SHA1:66C05F77D814424B9509DD828111D93BC9FA9811
                                                                                                                                                                                                                          SHA-256:79AC6F73C71CA8FDA442A42A116A34C62802F0F7E17729182899327971CFEB23
                                                                                                                                                                                                                          SHA-512:4B95A210C9A4539332E2FB894D7DE4E1B34894876CCD06EEC5B0FC6F6E47DE75C0E298CF2F3B5832C9E028861A53B8C8E8A172A3BE3EC29A2C9E346642412138
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6...r.h.r.h.r.h.{...p.h.g.i.p.h.9.i.q.h.r.i.V.h.g.m.y.h.g.l.z.h.g.k.q.h.H.`.s.h.H.h.s.h.H...s.h.H.j.s.h.Richr.h.........................PE..d....e.........." ...%............P........................................p............`..........................................'..P...0(..P....P.......@...............`..,...P#..............................."..@............ ...............................text............................... ..`.rdata....... ......................@..@.data...8....0......."..............@....pdata.......@.......$..............@..@.rsrc........P.......&..............@..@.reloc..,....`.......(..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\Util\_cpuid_c.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):10240
                                                                                                                                                                                                                          Entropy (8bit):4.730605326965181
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:MJVVdJvbrqTu6ZdpvY0IluLfcC75JiCKs89EVAElIijKDQGrbMZYJWJcX6gbW6s:CVddiT7pgTctEEaEDKDlMCWJcqgbW6
                                                                                                                                                                                                                          MD5:4D9C33AE53B38A9494B6FBFA3491149E
                                                                                                                                                                                                                          SHA1:1A069E277B7E90A3AB0DCDEE1FE244632C9C3BE4
                                                                                                                                                                                                                          SHA-256:0828CAD4D742D97888D3DFCE59E82369317847651BBA0F166023CB8ACA790B2B
                                                                                                                                                                                                                          SHA-512:BDFBF29198A0C7ED69204BF9E9B6174EBB9E3BEE297DD1EB8EB9EA6D7CAF1CC5E076F7B44893E58CCF3D0958F5E3BDEE12BD090714BEB5889836EE6F12F0F49E
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6...r.`.r.`.r.`.{...p.`.g.a.p.`.9.a.q.`.r.a.Q.`.g.e.y.`.g.d.z.`.g.c.q.`.H.h.s.`.H.`.s.`.H...s.`.H.b.s.`.Richr.`.................PE..d....e.........." ...%............P........................................p............`..........................................'..|....'..P....P.......@...............`..,...."...............................!..@............ ...............................text............................... ..`.rdata....... ......................@..@.data...8....0....... ..............@....pdata.......@......."..............@..@.rsrc........P.......$..............@..@.reloc..,....`.......&..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\Crypto\Util\_strxor.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):10240
                                                                                                                                                                                                                          Entropy (8bit):4.685843290341897
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:6ZVVdJvbrqTu6ZdpvY0IluLfcC75JiCKs89EMz3DHWMoG4BcX6gbW6O:IVddiT7pgTctEEO3DLoHcqgbW6
                                                                                                                                                                                                                          MD5:8F4313755F65509357E281744941BD36
                                                                                                                                                                                                                          SHA1:2AAF3F89E56EC6731B2A5FA40A2FE69B751EAFC0
                                                                                                                                                                                                                          SHA-256:70D90DDF87A9608699BE6BBEDF89AD469632FD0ADC20A69DA07618596D443639
                                                                                                                                                                                                                          SHA-512:FED2B1007E31D73F18605FB164FEE5B46034155AB5BB7FE9B255241CFA75FF0E39749200EB47A9AB1380D9F36F51AFBA45490979AB7D112F4D673A0C67899EF4
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6...r.`.r.`.r.`.{...p.`.g.a.p.`.9.a.q.`.r.a.Q.`.g.e.y.`.g.d.z.`.g.c.q.`.H.h.s.`.H.`.s.`.H...s.`.H.b.s.`.Richr.`.................PE..d....e.........." ...%............P........................................p............`.........................................`'..t....'..P....P.......@...............`..,...."...............................!..@............ ...............................text...x........................... ..`.rdata....... ......................@..@.data...8....0....... ..............@....pdata.......@......."..............@..@.rsrc........P.......$..............@..@.reloc..,....`.......&..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome\Cipher\_ARC4.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):11264
                                                                                                                                                                                                                          Entropy (8bit):4.704418348721006
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:nDzsc9VD9daQ2iTrqT+6Zdp/Q0I1uLfcC75JiC4Rs89EcYyGDj90OcX6gY/7ECFV:Dzs69damqTrpYTst0E5DjPcqgY/79X
                                                                                                                                                                                                                          MD5:85F144F57905F68ECBF14552BAB2F070
                                                                                                                                                                                                                          SHA1:83A20193E6229EA09DCCAE8890A74DBDD0A76373
                                                                                                                                                                                                                          SHA-256:28696C8881D9C9272DE4E54ABE6760CD4C6CB22AD7E3FEABAF6FF313EC9A9EAF
                                                                                                                                                                                                                          SHA-512:533EB4073594BFE97850DFF7353439BACD4E19539E247EE00D599F3468E162D2D88C5CA32322772538A73706DF9A6DD14553B35F47C686D2E20D915FAB766BDA
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........K...*b..*b..*b..R...*b..Uc..*b.Rc..*b..*c..*b..Ug..*b..Uf..*b..Ua..*b..j..*b..b..*b....*b..`..*b.Rich.*b.................PE..d...O..e.........." ...%............P........................................p............`.........................................P(.......(..d....P.......@...............`..,...."...............................!..@............ ...............................text............................... ..`.rdata..,.... ......................@..@.data...8....0......."..............@....pdata.......@.......$..............@..@.rsrc........P.......(..............@..@.reloc..,....`.......*..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome\Cipher\_Salsa20.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):13312
                                                                                                                                                                                                                          Entropy (8bit):4.968532257508093
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:JF3rugNlF/1Nt5aSd4+1ijg0NLfFNJSCqsstXHTeH5ht47qMbxbfDq4wYH/kcX6G:tF/1nb2mhQtkXHTeZ87VDqyMcqgYvEp
                                                                                                                                                                                                                          MD5:14A20ED2868F5B3D7DCFEF9363CB1F32
                                                                                                                                                                                                                          SHA1:C1F2EF94439F42AA39DCDE1075DEFAC8A6029DC6
                                                                                                                                                                                                                          SHA-256:A072631CD1757D5147B5E403D6A96EF94217568D1DC1AE5C67A1892FBF61409E
                                                                                                                                                                                                                          SHA-512:33BE8B3733380C3ADFE5D2844819C754FB11FCBC7AA75DA8FBB4D6CEF938E7D3267FBD215B9666DCFA5795D54484360A61DAF193BC75B57C252D44E5F9F0D855
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d...P..e.........." ...%............P.....................................................`..........................................8......x9..d....`.......P..L............p..,....3...............................1..@............0...............................text...(........................... ..`.rdata.......0......................@..@.data...8....@.......*..............@....pdata..L....P.......,..............@..@.rsrc........`.......0..............@..@.reloc..,....p.......2..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome\Cipher\_chacha20.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):13824
                                                                                                                                                                                                                          Entropy (8bit):5.061520684813544
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:cdF/1nb2mhQtkXn0t/WS60YYDEbqvdvGyv9lkVcqgYvEMo:e2f6XSZ6XYD5vdvGyv9MgYvEMo
                                                                                                                                                                                                                          MD5:E2AB7EECFD020CFDEBA6DD3ADD732EB7
                                                                                                                                                                                                                          SHA1:26975087F7AC8001830CAD4151003DBCABF82126
                                                                                                                                                                                                                          SHA-256:85BCF0FD811ADE1396E3A93EEEF6BC6B88D5555498BA09C164FAA3092DACDEFF
                                                                                                                                                                                                                          SHA-512:EB45126A07128E0FA8DC2B687F833BA95BB8703D7BC06E5C34F828EAEF062CFCA56D8A51A73B20DFA771595F6C6D830B659B5C0EB62467C61E95C97C4A73398D
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d...P..e.........." ...%............P.....................................................`..........................................8.......9..d....`.......P..d............p..,....2...............................1..@............0...............................text............................... ..`.rdata.......0......................@..@.data...8....@.......,..............@....pdata..d....P......................@..@.rsrc........`.......2..............@..@.reloc..,....p.......4..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome\Cipher\_pkcs1_decode.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):13824
                                                                                                                                                                                                                          Entropy (8bit):5.236611028290556
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:osiHXqpoUol3xZhRyQX5lDnRDFFav+tcqgRvE:K6D+XBDfDgRvE
                                                                                                                                                                                                                          MD5:7FA5B1642D52FABFE1D3EBD1080056D4
                                                                                                                                                                                                                          SHA1:56B9E87D613EE9A8B6B71A93ED5FA1603886139A
                                                                                                                                                                                                                          SHA-256:88C7EC96B9E1D168005B3A8727AAA7F76B4B2985083ED7A9FB0A2AB02446E963
                                                                                                                                                                                                                          SHA-512:9E0BF47060A2B7AC8FFD2CB8B845D44013C068BFE74926A67496D79BCB513506625BDA1DDF18ECE7777D1379F036506F19457D0A43FA618A8F75664C47798E64
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........K..*...*...*...R...*...U...*..R...*...*...*...U...*...U...*...U...*.....*.....*...}..*.....*..Rich.*..........................PE..d...N..e.........." ...%............P.....................................................`..........................................9.......9..d....`.......P..|............p..,....3...............................1..@............0...............................text............................... ..`.rdata.......0......................@..@.data...h....@.......,..............@....pdata..|....P......................@..@.rsrc........`.......2..............@..@.reloc..,....p.......4..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome\Cipher\_raw_aes.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):36352
                                                                                                                                                                                                                          Entropy (8bit):6.558039926510444
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:Dz5P+7nYpPMedFDlDchrVX1mEVmT9ZgkoD/PKDkGuF0U390QOo8VdbKBWmuTLg46:DzdqWB7YJlmLJ3oD/S4j990th9VTsC
                                                                                                                                                                                                                          MD5:E63FC8375E1D8C47FBB84733F38A9552
                                                                                                                                                                                                                          SHA1:995C32515AA183DA58F970CEDC6667FAE166615A
                                                                                                                                                                                                                          SHA-256:F47F9C559A9C642DA443896B5CD24DE74FED713BDF6A9CD0D20F5217E4124540
                                                                                                                                                                                                                          SHA-512:4213189F619E7AA71934033CABA401FE93801B334BA8D8EAFEDA89F19B13224C516E4BB4F4F93F6AE2C21CD8F5586D3FFAC3D16CB1242183B9302A1F408F6F6A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........K...*b..*b..*b..R...*b..Uc..*b.Rc..*b..*c..*b..Ug..*b..Uf..*b..Ua..*b..j..*b..b..*b....*b..`..*b.Rich.*b.................PE..d...L..e.........." ...%.H...H......P.....................................................`.................................................,...d...............................4... ...................................@............`...............................text....F.......H.................. ..`.rdata..d6...`...8...L..............@..@.data...8...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..4...........................@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome\Cipher\_raw_aesni.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):15872
                                                                                                                                                                                                                          Entropy (8bit):5.285246086368036
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:jJBjJHEkEPYi3Xd+dc26E4++yuqAyXW9wifD4mqccqgwYUMvEW:ZkRwi3wO26Ef+yuIm9PfDewgwYUMvE
                                                                                                                                                                                                                          MD5:A914F3D22DA22F099CB0FBFBBB75DDBF
                                                                                                                                                                                                                          SHA1:2834AEB657CA301D722D6D4D1672239C83BE97E3
                                                                                                                                                                                                                          SHA-256:4B4DBF841EC939EF9CC4B4F1B1BA436941A3F2AF2F4E34F82C568DFC09BA0358
                                                                                                                                                                                                                          SHA-512:15BF5FCE53FB2C524054D02C2E48E3DDC4EAC0C1F73325D58B04DFE17259C208FFAC0A7C634FBC2CF1A08E7F28C1FD456061BA0838F4316EB37514E1E8D4C95F
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........TX..:...:...:.....:..;...:...;...:...;...:..?...:..>...:..9...:..R2...:..R:...:..R....:..R8...:.Rich..:.................PE..d...L..e.........." ...%. ... ......P.....................................................`..........................................9......D:..d....`.......P...............p..,....3...............................1..@............0.. ............................text...h........ .................. ..`.rdata.......0.......$..............@..@.data...(....@.......4..............@....pdata.......P.......6..............@..@.rsrc........`.......:..............@..@.reloc..,....p.......<..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome\Cipher\_raw_arc2.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):16384
                                                                                                                                                                                                                          Entropy (8bit):5.505232918566824
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:9d9VkyQ5f8vjVaCHpKpTTjaNe7oca2DWZQ2dhmdcqgwNeecBih:rkP5cjIGpKlqD2DakzgwNeE
                                                                                                                                                                                                                          MD5:9F1A2A9D731E7755EE93C82C91FA5FE2
                                                                                                                                                                                                                          SHA1:41085FBE84E1B98A795871033034FA1F186274EF
                                                                                                                                                                                                                          SHA-256:17F3EAF463868B015583BD611BE5251E36AAB616522FF4072011B3D72F6F552F
                                                                                                                                                                                                                          SHA-512:7E29D4729837D87AEF34CFA7B1F86DFBB81907CD11FC575C4ED1B8A956409492315BFA76ADE4D7C51E51E37E5D098A7F4FEE4C58D86D0E6245A4AA0D392D488A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d...L..e.........." ...%."... ......P.....................................................`.........................................0J.......J..d....p.......`..................,....C...............................B..@............@...............................text....!.......".................. ..`.rdata.......@.......&..............@..@.data...8....P.......6..............@....pdata.......`.......8..............@..@.rsrc........p.......<..............@..@.reloc..,............>..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome\Cipher\_raw_blowfish.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):20992
                                                                                                                                                                                                                          Entropy (8bit):6.061115794354147
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:pUv5cJMOZA0nmwBD+XpJgLa0Mp8QHg4P2llyM:GK1XBD+DgLa1gTi
                                                                                                                                                                                                                          MD5:883DE82B3B17F95735F579E78A19D509
                                                                                                                                                                                                                          SHA1:3EC7259ACA3730B2A6F4E1CA5121DB4AB41C619E
                                                                                                                                                                                                                          SHA-256:67FF6C8BBDC9E33B027D53A26DF39BA2A2AD630ACCE1BAC0B0583CA31ADF914F
                                                                                                                                                                                                                          SHA-512:602915EAA0933F5D1A26ECC1C32A8367D329B12794CBF2E435B1704E548858E64710AB52BC6FC14FC98DF0B8EEBDE2B32A35BCF935079CC8E2412C07DF5303FD
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d...L..e.........." ...%.$...0......P.....................................................`.........................................pY.......Z..d............p..................4...@S...............................R..@............@...............................text....".......$.................. ..`.rdata..L....@... ...(..............@..@.data...8....`.......H..............@....pdata.......p.......J..............@..@.rsrc................N..............@..@.reloc..4............P..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome\Cipher\_raw_cast.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):25088
                                                                                                                                                                                                                          Entropy (8bit):6.475398255636883
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:Zc6HLZiMDFuGu+XHZXmrfXA+UA10ol31tuXy7IYgLWi:q6H1TZXX5XmrXA+NNxWi0dLWi
                                                                                                                                                                                                                          MD5:0AC22DA9F0B2F84DE9D2B50D457020C1
                                                                                                                                                                                                                          SHA1:682E316AE958121D0E704CAB0F78CCAD42C77573
                                                                                                                                                                                                                          SHA-256:480C79C713AD15328E9EB9F064B90BCDCB5AAD149236679F97B61218F6D2D200
                                                                                                                                                                                                                          SHA-512:11C04D55C5E73583D658E0918BD5A37C7585837A6E0F3C78AEF10A5D7A5C848B0620028177A9D9B0AD5DB882B2A26624F92BEFC9BC8F8A23C002723E50DD80A5
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d...M..e.........." ...%.$...@............................................................`.........................................@i.......i..d...............................4....b...............................a..@............@...............................text....#.......$.................. ..`.rdata.......@...0...(..............@..@.data...8....p.......X..............@....pdata...............Z..............@..@.rsrc................^..............@..@.reloc..4............`..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome\Cipher\_raw_cbc.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):12288
                                                                                                                                                                                                                          Entropy (8bit):4.839420412830416
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:CF/1nb2mhQtkr+juOxKbDbRHcqgYvEkrK:42f6iuOsbDXgYvEmK
                                                                                                                                                                                                                          MD5:6840F030DF557B08363C3E96F5DF3387
                                                                                                                                                                                                                          SHA1:793A8BA0A7BDB5B7E510FC9A9DDE62B795F369AE
                                                                                                                                                                                                                          SHA-256:B7160ED222D56925E5B2E247F0070D5D997701E8E239EC7F80BCE21D14FA5816
                                                                                                                                                                                                                          SHA-512:EDF5A4D5A3BFB82CC140CE6CE6E9DF3C8ED495603DCF9C0D754F92F265F2DCE6A83F244E0087309B42930D040BF55E66F34504DC1C482A274AD8262AA37D1467
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d...N..e.........." ...%............P.....................................................`..........................................8.......9..d....`.......P..X............p..,....2...............................1..@............0...............................text............................... ..`.rdata.......0......................@..@.data...8....@.......&..............@....pdata..X....P.......(..............@..@.rsrc........`.......,..............@..@.reloc..,....p......................@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome\Cipher\_raw_cfb.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):13824
                                                                                                                                                                                                                          Entropy (8bit):4.905258571193623
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:fRgPX8lvI+KnwSDTPUDEnKWPXcqgzQkvEd:4og9rUD/mpgzQkvE
                                                                                                                                                                                                                          MD5:7256877DD2B76D8C6D6910808222ACD8
                                                                                                                                                                                                                          SHA1:C6468DB06C4243CE398BEB83422858B3FED76E99
                                                                                                                                                                                                                          SHA-256:DBF703293CFF0446DFD15BBAEDA52FB044F56A353DDA3BECA9AADD8A959C5798
                                                                                                                                                                                                                          SHA-512:A14D460D96845984F052A8509E8FC44439B616EEAE46486DF20F21CCAA8CFB1E55F1E4FA2F11A7B6AB0A481DE62636CEF19EB5BEF2591FE83D415D67EB605B8E
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........K...*...*...*...RQ..*...U...*..R...*...*...*...U...*...U...*...U...*......*......*...=..*......*..Rich.*..................PE..d...N..e.........." ...%..... ......P.....................................................`..........................................9.......9..d....`.......P..d............p..,....3...............................1..@............0...............................text...(........................... ..`.rdata.......0......................@..@.data...8....@.......,..............@....pdata..d....P......................@..@.rsrc........`.......2..............@..@.reloc..,....p.......4..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome\Cipher\_raw_ctr.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):14848
                                                                                                                                                                                                                          Entropy (8bit):5.300728193650235
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:jGYJ1gSHxKkwv0i8XSi3Sm57NEEE/qexUEtDr6krRcqgUF6+6vEX:jR01si8XSi3SACqe7tDlDgUUjvE
                                                                                                                                                                                                                          MD5:B063D73E5AA501060C303CAFBC72DAD3
                                                                                                                                                                                                                          SHA1:8C1CA04A8ED34252EB233C993DDBA17803E0B81E
                                                                                                                                                                                                                          SHA-256:98BACA99834DE65FC29EFA930CD9DBA8DA233B4CFDFC4AB792E1871649B2FE5C
                                                                                                                                                                                                                          SHA-512:8C9AD249F624BDF52A3C789C32532A51D3CC355646BD725553A738C4491EA483857032FB20C71FD3698D7F68294E3C35816421DFF263D284019A9A4774C3AF05
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........K,..*B..*B..*B..R...*B..UC..*B.RC..*B..*C..*B..UG..*B..UF..*B..UA..*B..J..*B..B..*B....*B..@..*B.Rich.*B.........................PE..d...O..e.........." ...%..... ......P.....................................................`..........................................9......x:..d....`.......P...............p..,....3...............................1..@............0.. ............................text............................... ..`.rdata.......0....... ..............@..@.data........@.......0..............@....pdata.......P.......2..............@..@.rsrc........`.......6..............@..@.reloc..,....p.......8..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome\Cipher\_raw_des.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):57856
                                                                                                                                                                                                                          Entropy (8bit):4.260136375669177
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:9RUqVT1dZ/GHkJnYcZiGKdZHDLtiduprZvZY0JAIg+v:9rHGHfJidIK
                                                                                                                                                                                                                          MD5:3AEA5302F7F03EDEFF49D1C119C61693
                                                                                                                                                                                                                          SHA1:DBDDE1C10B253744153FC1F47C078AAACCF3F3A6
                                                                                                                                                                                                                          SHA-256:E5DDA67D4DF47B7F00FF17BE6541CA80BDB4B60E1F6FD1A7D7F115DDF7683EE5
                                                                                                                                                                                                                          SHA-512:DD42C24EDAF7E1B25A51BC8C96447496B3289C612C395CA7BD8BF60A162229C2E0CA0432CDDF1CB2D65D80189DB02BEE42FFD0E7DD9E5FC19278CA3FD593AB2C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........A.........................................................K......K......Ki.....K.....Rich...........................PE..d...M..e.........." ...%.8...................................................0............`.....................................................d...............l............ ..4...................................@...@............P...............................text....7.......8.................. ..`.rdata..f....P.......<..............@..@.data...8...........................@....pdata..l...........................@..@.rsrc...............................@..@.reloc..4.... ......................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome\Cipher\_raw_des3.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):58368
                                                                                                                                                                                                                          Entropy (8bit):4.276947153784193
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:98Uqho9weF5/eHkRnYcZiGKdZHDL7idErZ8ZYXGg:9gCneH//idv2
                                                                                                                                                                                                                          MD5:BA5BA714AEBFD8130EB6E0983FBAE20B
                                                                                                                                                                                                                          SHA1:3309C26A9083EC3AD982DD3D6630FCC16465F251
                                                                                                                                                                                                                          SHA-256:861167DFEB390261E538D635EAD213E81C1166D8D85A496774FBF2EBFF5A4332
                                                                                                                                                                                                                          SHA-512:309CC3FD8DB62517AE70B404C5ACD01052F10582A17123135CD1A28D3A74AB28F90A8E7ED7D2061A4B6C082F85E98DA822D43986FC99367B288A72BA9F8B5569
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........A.........................................................K......K......Ki.....K.....Rich...........................PE..d...N..e.........." ...%.:...................................................0............`.................................................P...d............................ ..4...................................@...@............P...............................text...x9.......:.................. ..`.rdata.......P.......>..............@..@.data...8...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..4.... ......................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome\Cipher\_raw_ecb.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):10752
                                                                                                                                                                                                                          Entropy (8bit):4.579354442149926
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:j0qVVdJvbrqTu6ZdpvY0IluLfcC75JiCKs89EpmFWLOXDwoYPj15XkcX6gbW6z:pVddiT7pgTctEEI4qXDe11kcqgbW6
                                                                                                                                                                                                                          MD5:1C74E15EC55BD8767968024D76705EFC
                                                                                                                                                                                                                          SHA1:C590D1384D2207B3AF01A46A5B4F7A2AE6BCAD93
                                                                                                                                                                                                                          SHA-256:0E3EC56A1F3C86BE1CAA503E5B89567AA91FD3D6DA5AD4E4DE4098F21270D86B
                                                                                                                                                                                                                          SHA-512:E96CA56490FCE7E169CC0AB803975BAA8B5ACB8BBAB5047755AE2EEAE177CD4B852C0620CD77BCFBC81AD18BB749DEC65D243D1925288B628F155E8FACDC3540
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6...r.`.r.`.r.`.{...p.`.g.a.p.`.9.a.q.`.r.a.Q.`.g.e.y.`.g.d.z.`.g.c.q.`.H.h.s.`.H.`.s.`.H...s.`.H.b.s.`.Richr.`.................PE..d...N..e.........." ...%............P........................................p............`.........................................p'......((..P....P.......@...............`..,...."...............................!..@............ ...............................text............................... ..`.rdata....... ......................@..@.data...8....0......."..............@....pdata.......@.......$..............@..@.rsrc........P.......&..............@..@.reloc..,....`.......(..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome\Cipher\_raw_eksblowfish.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):22016
                                                                                                                                                                                                                          Entropy (8bit):6.143744403797058
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:7Uv5cRUtPQtjLJiKMjNrDF6pJgLa0Mp8Qy0gYP2lXCM:UKR8I+K0lDFQgLa1WzU
                                                                                                                                                                                                                          MD5:E7826C066423284539BD1F1E99BA0CC6
                                                                                                                                                                                                                          SHA1:DA7372EEB180C2E9A6662514A8FA6261E04AC6DC
                                                                                                                                                                                                                          SHA-256:0E18B7C2686BB954A8EE310DD5FDB76D00AC078A12D883028BFFC336E8606DA2
                                                                                                                                                                                                                          SHA-512:55F8B00B54F3C3E80803D5A3611D5301E29A2C6AF6E2CAA36249AEBA1D4FCC5A068875B34D65106C137F0455F11B20226B48EEF687F5EA73DFEA3C852BF07050
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d...M..e.........." ...%.(...0......P.....................................................`.........................................pY.......Z..d............p..................4...@S...............................R..@............@...............................text...X'.......(.................. ..`.rdata..T....@... ...,..............@..@.data...8....`.......L..............@....pdata.......p.......N..............@..@.rsrc................R..............@..@.reloc..4............T..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome\Cipher\_raw_ocb.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):17920
                                                                                                                                                                                                                          Entropy (8bit):5.353670931504009
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:tPHNP3Mj7Be/yB/6sB3yxcb+IMcOYqQViCBD8Ng6Vf4A:DPcnB8KSsB34cb+bcOYpMCBDB
                                                                                                                                                                                                                          MD5:D5DB7192A65D096433F5F3608E5AD922
                                                                                                                                                                                                                          SHA1:22AD6B635226C8F6B94F85E4FBFB6F8C18B613C8
                                                                                                                                                                                                                          SHA-256:FAB286E26160820167D427A4AAB14BE4C23883C543E2B0C353F931C89CEA3638
                                                                                                                                                                                                                          SHA-512:5503E83D68D144A6D182DCC5E8401DD81C1C98B04B5ED24223C77D94B0D4F2DD1DD05AED94B9D619D30D2FE73DFFA6E710664FFC71B8FA53E735F968B718B1D9
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d...O..e.........." ...%.(... ......P.....................................................`..........................................I.......J..d....p.......`..................,....C...............................A..@............@...............................text....'.......(.................. ..`.rdata..8....@.......,..............@..@.data........P.......<..............@....pdata.......`.......>..............@..@.rsrc........p.......B..............@..@.reloc..,............D..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome\Cipher\_raw_ofb.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):12288
                                                                                                                                                                                                                          Entropy (8bit):4.741875402338703
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:sCF/1nb2mhQtkgU7L9D0E7tfcqgYvEJPb:N2f6L9D5JxgYvEJj
                                                                                                                                                                                                                          MD5:134F891DE4188C2428A2081E10E675F0
                                                                                                                                                                                                                          SHA1:22CB9B0FA0D1028851B8D28DAFD988D25E94D2FD
                                                                                                                                                                                                                          SHA-256:F326AA2A582B773F4DF796035EC9BF69EC1AD11897C7D0ECFAB970D33310D6BA
                                                                                                                                                                                                                          SHA-512:43CE8AF33630FD907018C62F100BE502565BAD712AD452A327AE166BD305735799877E14BE7A46D243D834F3F884ABF6286088E30533050ED9CD05D23AACAEAB
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d...O..e.........." ...%............P.....................................................`..........................................8.......9..d....`.......P..X............p..,....2...............................1..@............0...............................text............................... ..`.rdata.......0......................@..@.data...8....@.......&..............@....pdata..X....P.......(..............@..@.rsrc........`.......,..............@..@.reloc..,....p......................@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome\Hash\_BLAKE2b.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):14848
                                                                                                                                                                                                                          Entropy (8bit):5.213290591994899
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:oF/1nb2mhQtkRySMfJ2ycxFzShJD9dAal2QDeJKcqgQx2QY:C2fKRQB2j8JD4fJagQx2QY
                                                                                                                                                                                                                          MD5:7D6979D69CD34652D5A3A197300AB65C
                                                                                                                                                                                                                          SHA1:E9C7EF62B7042B3BAC75B002851C41EFEEE343CE
                                                                                                                                                                                                                          SHA-256:2365B7C2AF8BBAC3844B7BEF47D5C49C234A159234A153515EB0634EEC0557CC
                                                                                                                                                                                                                          SHA-512:CBDBE0DF4F6CB6796D54969B0EEF06C0CDA86FF34A2B127BF0272C819FB224D6E5393D5C9B31E53A24EAC9A3A1AEA6E0854A8D7911CF7C4C99292C931B8B05DF
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d...J..e.........." ...%..... ......P.....................................................`..........................................9......|:..d....`.......P..@............p..,....3...............................2..@............0...............................text...X........................... ..`.rdata.......0....... ..............@..@.data...8....@.......0..............@....pdata..@....P.......2..............@..@.rsrc........`.......6..............@..@.reloc..,....p.......8..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome\Hash\_BLAKE2s.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):14336
                                                                                                                                                                                                                          Entropy (8bit):5.181893965844124
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:cF/1nb2mhQt7fSOp/CJPvADQoKtxSOvbcqgEvcM+:22fNKOZWPIDMxVlgEvL
                                                                                                                                                                                                                          MD5:C3BA97B2D8FFFDB05F514807C48CABB2
                                                                                                                                                                                                                          SHA1:7BC7FBDE6A372E5813491BBD538FD49C0A1B7C26
                                                                                                                                                                                                                          SHA-256:4F78E61B376151CA2D0856D2E59976670F5145FBABAB1EEC9B2A3B5BEBB4EEF6
                                                                                                                                                                                                                          SHA-512:57C1A62D956D8C6834B7BA81C2D125A40BF466E833922AE3759CF2C1017F8CAF29F4502A5A0BCBC95D74639D86BAF20F0335A45F961CFCAC39B4ED81E318F4EB
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d...K..e.........." ...%..... ......P.....................................................`.........................................09.......9..d....`.......P..@............p..,....3...............................2..@............0...............................text...8........................... ..`.rdata..4....0......................@..@.data...8....@......................@....pdata..@....P.......0..............@..@.rsrc........`.......4..............@..@.reloc..,....p.......6..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome\Hash\_MD2.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):14336
                                                                                                                                                                                                                          Entropy (8bit):5.1399121410532445
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:HsiHXqpo0cUp8XnUp8XjEQnlDtTI6rcqgcx2:J6DcUp8XUp8AclDy69gcx2
                                                                                                                                                                                                                          MD5:BB4CF5E97D4031B47CC7B7DAEDA005DD
                                                                                                                                                                                                                          SHA1:4F596DCE9A8546AE22BA8851B22FCE62C2C69973
                                                                                                                                                                                                                          SHA-256:325512FF7E0261AF1DA4760C5A8BB8BA7BA8C532F0068D770621CD2CC89E04C6
                                                                                                                                                                                                                          SHA-512:93088745BA922918A8EBC20C7043DA4C3C639245547BE665D15625B7F808EC0BF120841ACEEFCE71134921EF8379821769DE35D32CCCC55E6B391C57C7F4D971
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d...A..e.........." ...%..... ......P.....................................................`..........................................9......0:..d....`.......P..(............p..,....4...............................2..@............0...............................text............................... ..`.rdata.......0......................@..@.data...h....@......................@....pdata..(....P.......0..............@..@.rsrc........`.......4..............@..@.reloc..,....p.......6..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome\Hash\_MD4.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):13824
                                                                                                                                                                                                                          Entropy (8bit):5.204576067987685
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:JsiHXqpwUiv6wPf+4WVrd1DFrXqwWwcqgfvE:36biio2Pd1DFrlgfvE
                                                                                                                                                                                                                          MD5:D2131380B7760D5BC3C2E1772C747830
                                                                                                                                                                                                                          SHA1:DA5838E1C6DF5EC45AC0963E98761E9188A064D0
                                                                                                                                                                                                                          SHA-256:6DB786B30F6682CD699E22D0B06B873071DCC569557B6EB6EC1416689C0890FE
                                                                                                                                                                                                                          SHA-512:594939FB1D9154E15106D4B4AA9EF51A6AE5062D471ED7C0779A8E3D84D8F4B1481529015E0926A3489119DA37BE6CFE70C70ED695A6E84F6AF8F65402F6AAB5
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d...B..e.........." ...%............P.....................................................`.........................................p8...... 9..d....`.......P..(............p..,...@3...............................2..@............0...............................text...X........................... ..`.rdata..p....0......................@..@.data...p....@.......,..............@....pdata..(....P......................@..@.rsrc........`.......2..............@..@.reloc..,....p.......4..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome\Hash\_MD5.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):15360
                                                                                                                                                                                                                          Entropy (8bit):5.4787123381499825
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:3Z9WXA7M93g8U7soSchhiLdjM5J6ECTGmDZuRsP0rcqgjPrvE:SQ0gH7zSccA5J6ECTGmDMa89gjPrvE
                                                                                                                                                                                                                          MD5:CAF687A7786892939FFF5D5B6730E069
                                                                                                                                                                                                                          SHA1:96C2567A770E12C15903767A85ABF8AF57FE6D6A
                                                                                                                                                                                                                          SHA-256:9001E0C50D77823D64C1891F12E02E77866B9EDE783CEF52ED4D01A32204781B
                                                                                                                                                                                                                          SHA-512:0B3C9E5C1F7EF52E615D9E1E6F7D91324BAB7C97FFAFB6DBAEB229CF1B86420A3534493C34DD9FAEB4BBC3612F245248ABA34393311C31500D827538DFE24BC5
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d...B..e.........." ...%. ..........P.....................................................`..........................................8.......9..d....`.......P..X............p..,....3...............................1..@............0...............................text............ .................. ..`.rdata.......0.......$..............@..@.data........@.......2..............@....pdata..X....P.......4..............@..@.rsrc........`.......8..............@..@.reloc..,....p.......:..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome\Hash\_RIPEMD160.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):18432
                                                                                                                                                                                                                          Entropy (8bit):5.69653684522693
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:pkP5RjF7GsIyV6Lx41NVYaVmtShQRKAa8+D0ngkov:2nx7RI26LuuHKz8+D5N
                                                                                                                                                                                                                          MD5:9762DBF0527A46F21852CA5303E245C3
                                                                                                                                                                                                                          SHA1:33333912F16BB755B0631D8308D94DA2D7589127
                                                                                                                                                                                                                          SHA-256:0DF91D69B8D585D2660168125E407E3CB3D87F338B3628E5E0C2BF49C9D20DB8
                                                                                                                                                                                                                          SHA-512:52687C38939710C90A8C97F2C465AF8CF0309E3939255427B88BC461E27FADA79B0CB31F8BD215F72B610CAC093934C066141B9298353F04CC067C4E68B31DF0
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d...J..e.........." ...%.*... ......P.....................................................`..........................................I.......J..d....p.......`..................,....D..............................PC..@............@...............................text....).......*.................. ..`.rdata.......@......................@..@.data...8....P.......>..............@....pdata.......`.......@..............@..@.rsrc........p.......D..............@..@.reloc..,............F..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome\Hash\_SHA1.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):19456
                                                                                                                                                                                                                          Entropy (8bit):5.798411671336839
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:cPHNP3MjevhSY/8EBbVxcJ0ihTLdFDUPHgj+kf4D:mPcKvr/jUJ0sbDoAj+t
                                                                                                                                                                                                                          MD5:74DAAAB71F93BCE184D507A45A88985C
                                                                                                                                                                                                                          SHA1:3D09D69E94548EC6975177B482B68F86EDA32BB8
                                                                                                                                                                                                                          SHA-256:E781D6DAF2BAAA2C1A45BD1CDDB21BA491442D49A03255C1E367F246F17E13BF
                                                                                                                                                                                                                          SHA-512:870EC2752304F12F2F91BE688A34812AC1C75D444A0107284E3C45987639D8D07116EB98DB76931F9C8487666E1B2C163FC5743BBFC5A72F20F040670CDEB509
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d...B..e.........." ...%.0..........P.....................................................`..........................................H.......I..d....p.......`..X...............,....C...............................A..@............@...............................text..../.......0.................. ..`.rdata.......@.......4..............@..@.data........P.......B..............@....pdata..X....`.......D..............@..@.rsrc........p.......H..............@..@.reloc..,............J..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome\Hash\_SHA224.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):22016
                                                                                                                                                                                                                          Entropy (8bit):5.86552932624144
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:V1jwGPJHLvzcY1EEerju9LcTZ6RO3RouLKtcyDNOhwgjxo:XjwyJUYToZwOLuzDNU1j
                                                                                                                                                                                                                          MD5:92587A131875FF7DC137AA6195B8BD81
                                                                                                                                                                                                                          SHA1:2BA642DDC869AB329893795704BFE3F23C7B6ECB
                                                                                                                                                                                                                          SHA-256:D2A9484134A65EFF74F0BDA9BB94E19C4964B6C323667D68B4F45BB8A7D499FC
                                                                                                                                                                                                                          SHA-512:62823A0168B415045A093ACC67E98B5E33908380860B04AA0568B04F39DE957DA30F929459C766DC9782EFC3143DCD2F4950E3876669E680B6910C213300B565
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d...F..e.........." ...%.8... ......P.....................................................`..........................................Z.......[..d............p..................,... T...............................R..@............P...............................text....6.......8.................. ..`.rdata.......P.......<..............@..@.data........`.......L..............@....pdata.......p.......N..............@..@.rsrc................R..............@..@.reloc..,............T..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome\Hash\_SHA256.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):22016
                                                                                                                                                                                                                          Entropy (8bit):5.867427817795374
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:b1jwGPJHLxzcY1EEerju9LcTZ6RO3RouLKtcyDNWegjxo:ZjwyJOYToZwOLuzDNW7j
                                                                                                                                                                                                                          MD5:B4E18C9A88A241FD5136FAF33FB9C96A
                                                                                                                                                                                                                          SHA1:077AF274AA0336880391E2F38C873A72BFC1DE3B
                                                                                                                                                                                                                          SHA-256:E50DB07E18CB84827B0D55C7183CF580FB809673BCAFBCEF60E83B4899F3AA74
                                                                                                                                                                                                                          SHA-512:81A059115627025A7BBF8743B48031619C13A513446B0D035AA25037E03B6A544E013CAAEB139B1BE9BA7D0D8CF28A5E7D4CD1B8E17948830E75BDFBD6AF1653
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d...D..e.........." ...%.8... ......P.....................................................`..........................................Z.......[..d............p..................,... T...............................R..@............P...............................text....6.......8.................. ..`.rdata.......P.......<..............@..@.data........`.......L..............@....pdata.......p.......N..............@..@.rsrc................R..............@..@.reloc..,............T..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome\Hash\_SHA384.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):27136
                                                                                                                                                                                                                          Entropy (8bit):5.860145427724178
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:TFDL3RqE3MjjQ95UnLa+1WT1aA7qHofg5JptfISH2mDDFfgjVx2:xDLh98jjRe+1WT1aAeIfMzxH2mDDqj
                                                                                                                                                                                                                          MD5:34A0AD8A0EB6AC1E86DC8629944448ED
                                                                                                                                                                                                                          SHA1:EF54E4C92C123BE341567A0ACC17E4CEE7B9F7A8
                                                                                                                                                                                                                          SHA-256:03E93C2DCC19C3A0CDD4E8EFCDE90C97F6A819DFECF1C96495FDC7A0735FAA97
                                                                                                                                                                                                                          SHA-512:A38EDE4B46DC9EFA80DFB6E019379809DF78A671F782660CD778427482B0F5987FA80A42C26FB367604BAFCD4FD21ABD1C833DAF2D4AEA3A43877F54D6906E21
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d...G..e.........." ...%.J..."......P.....................................................`......................................... l.......m..d...............................,....e...............................d..@............`...............................text...hH.......J.................. ..`.rdata..X....`.......N..............@..@.data................`..............@....pdata...............b..............@..@.rsrc................f..............@..@.reloc..,............h..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome\Hash\_SHA512.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):27136
                                                                                                                                                                                                                          Entropy (8bit):5.916758045478156
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:LFYLXRqEnMgj969GUnLa+1WT1aA7qHofg5JptfIS320DXCElrgjhig:5YLB9Mgj0e+1WT1aAeIfMzx320DXR+j
                                                                                                                                                                                                                          MD5:F028511CD5F2F925FD5A979152466CB4
                                                                                                                                                                                                                          SHA1:38B8B44089B390E1F3AA952C950BDBE2CB69FBA5
                                                                                                                                                                                                                          SHA-256:0FB591416CC9520C6D9C398E1EDF4B7DA412F80114F80628F84E9D4D37A64F69
                                                                                                                                                                                                                          SHA-512:97C06A4DCEE7F05268D0A47F88424E28B063807FFBD94DABDCC3BF773AD933A549934916EB7339506624E97829AA5DC13321ADE31D528E8424FFDCF8C8407D4F
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d...I..e.........." ...%.J..."......P.....................................................`..........................................l.......m..d...............................,...@f...............................e..@............`...............................text....H.......J.................. ..`.rdata.......`.......N..............@..@.data................`..............@....pdata...............b..............@..@.rsrc................f..............@..@.reloc..,............h..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome\Hash\_ghash_clmul.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):12800
                                                                                                                                                                                                                          Entropy (8bit):5.0002940201841
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:Dz/RF/1nb2mhQtk4axusjfkgZhoYDQmRjcqgQvEty:Dz/d2f64axnTTz5DTgQvEty
                                                                                                                                                                                                                          MD5:87C1C89CEB6DF9F62A8F384474D27A4A
                                                                                                                                                                                                                          SHA1:B0FC912A8DE5D9C18F603CD25AE3642185FFFBDD
                                                                                                                                                                                                                          SHA-256:D2256A5F1D3DC6AE38B73EA2DB87735724D29CB400D00D74CF8D012E30903151
                                                                                                                                                                                                                          SHA-512:C7DFB9C8E4F4AA984416BC84E829F0BB6CD87829C86BA259EE2A9BAB7C16B15362DB9EC87BF2ACED44A6BED7B1DE03DC9450665D083205B4CD4780DCF480DA01
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........K...*b..*b..*b..R...*b..Uc..*b.Rc..*b..*c..*b..Ug..*b..Uf..*b..Ua..*b..j..*b..b..*b....*b..`..*b.Rich.*b.................PE..d...K..e.........." ...%............P.....................................................`..........................................8......89..d....`.......P...............p..,....3...............................1..@............0...............................text............................... ..`.rdata.......0......................@..@.data...8....@.......(..............@....pdata.......P.......*..............@..@.rsrc........`......................@..@.reloc..,....p.......0..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome\Hash\_ghash_portable.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):13312
                                                                                                                                                                                                                          Entropy (8bit):5.025717576776578
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:FF/1nb2mhQtks0iiNqdF4mtPjD0HA5APYcqgYvEL2x:R2f6fFA/4GjDucgYvEL2x
                                                                                                                                                                                                                          MD5:20702216CDA3F967DF5C71FCE8B9B36F
                                                                                                                                                                                                                          SHA1:4D9A814EE2941A175BC41F21283899D05831B488
                                                                                                                                                                                                                          SHA-256:3F73F9D59EB028B7F17815A088CEB59A66D6784FEEF42F2DA08DD07DF917DD86
                                                                                                                                                                                                                          SHA-512:0802CF05DAD26E6C5575BBECB419AF6C66E48ED878F4E18E9CEC4F78D6358D751D41D1F0CCB86770A46510B993B70D2B320675422A6620CE9843E2E42193DCD8
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d...K..e.........." ...%............P.....................................................`..........................................8......h9..d....`.......P..X............p..,....2...............................1..@............0...............................text............................... ..`.rdata.......0......................@..@.data...8....@.......*..............@....pdata..X....P.......,..............@..@.rsrc........`.......0..............@..@.reloc..,....p.......2..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome\Hash\_keccak.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):16384
                                                                                                                                                                                                                          Entropy (8bit):5.235441330454107
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:VTRgffnRaNfBj9xih1LPK73jm6AXiN4rSRIh42gD/gvrjcqgCieT3WQ:VafgNpj9cHW3jqXeBRamD4ZgCieT
                                                                                                                                                                                                                          MD5:F065FFB04F6CB9CDB149F3C66BC00216
                                                                                                                                                                                                                          SHA1:B2BC4AF8A3E06255BAB15D1A8CF4A577523B03B6
                                                                                                                                                                                                                          SHA-256:E263D7E722EC5200E219D6C7D8B7C1B18F923E103C44A0B5485436F7B778B7BD
                                                                                                                                                                                                                          SHA-512:93E583B10D0F2BBB1D5539FF4E943A65BC67F6DFC51E5F991481574F58757F4D49A87022E551069F6FC55D690F7B1412CF5DE7DD9BEE27FB826853CE9ACC2B40
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d...J..e.........." ...%."... ......P.....................................................`.........................................`I......TJ..d....p.......`..p...............,....C...............................B..@............@...............................text...(!.......".................. ..`.rdata.......@.......&..............@..@.data........P.......6..............@....pdata..p....`.......8..............@..@.rsrc........p.......<..............@..@.reloc..,............>..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome\Hash\_poly1305.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):15360
                                                                                                                                                                                                                          Entropy (8bit):5.133851517560629
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:zZNGXEgvUh43G6coX2SSwmPL4V7wTdDlDaY2cqgWjvE:mVMhuGGF2L4STdDEYWgWjvE
                                                                                                                                                                                                                          MD5:213AAEC146F365D950014D7FFF381B06
                                                                                                                                                                                                                          SHA1:66FCD49E5B2278CD670367A4AC6704A59AE82B50
                                                                                                                                                                                                                          SHA-256:CAF315A9353B2306880A58ECC5A1710BFE3AA35CFEAD7CF0528CAEE4A0629EAD
                                                                                                                                                                                                                          SHA-512:0880D7D2B2C936A4B85E6C2A127B3509B76DB4751A3D8A7BB903229CABC8DE7A7F52888D67C886F606E21400DFC51C215D1CF9C976EB558EA70975412840883A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d...K..e.........." ...%..... ......P.....................................................`......................................... 9.......9..d....`.......P..|............p..,....3...............................1..@............0...............................text...X........................... ..`.rdata..(....0......."..............@..@.data........@.......2..............@....pdata..|....P.......4..............@..@.rsrc........`.......8..............@..@.reloc..,....p.......:..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome\Math\_modexp.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):35840
                                                                                                                                                                                                                          Entropy (8bit):5.927928056434685
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:KbEkzS7+k9rMUb8cOe9rs9ja+V/Mhxh56GS:KbEP779rMtcOCs0I/Mjf
                                                                                                                                                                                                                          MD5:732938D696EB507AF4C37795A4F9FCEA
                                                                                                                                                                                                                          SHA1:FD585EA8779C305ADBE3574BE95CFD06C9BBD01C
                                                                                                                                                                                                                          SHA-256:1383269169AB4D2312C52BF944BD5BB80A36D378FD634D7C1B8C3E1FFC0F0A8C
                                                                                                                                                                                                                          SHA-512:E4EBC5470F3D05D79B65BC2752A7FF40F5525CD0813BDDECCB1042EE2286B733EE172383186E89361A49CBE0B4B14F8B2CBC0F32E475101385C634120BB36676
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......N4.|.U./.U./.U./.-a/.U./.*...U./A-...U./.U./!U./.*...U./.*...U./.*...U./0....U./0....U./0../.U./0....U./Rich.U./................PE..d...S..e.........." ...%.^...0......`.....................................................`..........................................~..|...\...d...............................,....s...............................q..@............p..(............................text...8].......^.................. ..`.rdata.......p.......b..............@..@.data................v..............@....pdata..............................@..@.rsrc...............................@..@.reloc..,...........................@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome\Protocol\_scrypt.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):12288
                                                                                                                                                                                                                          Entropy (8bit):4.799297116284292
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:UkCfXASTMeAk4OepIXcADpOX6RcqgO5vE:+JMcPepIXcADq63gO5vE
                                                                                                                                                                                                                          MD5:9E7B28D6AB7280BBB386C93EF490A7C1
                                                                                                                                                                                                                          SHA1:B088F65F3F6E2B7D07DDBE86C991CCD33535EF09
                                                                                                                                                                                                                          SHA-256:F84667B64D9BE1BCC6A91650ABCEE53ADF1634C02A8A4A8A72D8A772432C31E4
                                                                                                                                                                                                                          SHA-512:16A6510B403BF7D9ED76A654D8C7E6A0C489B5D856C231D12296C9746AC51CD372CC60CA2B710606613F7BC056A588C54EA24F9C0DA3020BBEA43E43CEEB9CA4
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........K...*...*...*...RQ..*...U...*..R...*...*...*...U...*...U...*...U...*......*......*...=..*......*..Rich.*..................PE..d...P..e.........." ...%............P.....................................................`..........................................8..d...$9..d....`.......P..4............p..,....3...............................1..@............0...............................text...x........................... ..`.rdata.......0......................@..@.data........@.......&..............@....pdata..4....P.......(..............@..@.rsrc........`.......,..............@..@.reloc..,....p......................@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome\PublicKey\_ec_ws.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):754688
                                                                                                                                                                                                                          Entropy (8bit):7.6249603206444005
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:l1UrmZ9HoxJ8gf1266y8IXhJvCKAmqVLzcrZgYIMGv1iLD9yQvG6hM:XYmzHoxJFf1p34hcrn5Go9yQO6q
                                                                                                                                                                                                                          MD5:102898D47B45548E7F7E5ECC1D2D1FAA
                                                                                                                                                                                                                          SHA1:DDAE3A3BDD8B83AF42126245F6CB24DC2202BC04
                                                                                                                                                                                                                          SHA-256:C9BF3CF5707793C6026BFF68F2681FAAD29E953ED891156163CD0B44A3628A92
                                                                                                                                                                                                                          SHA-512:85A42FC08C91AFF50A9FF196D6FE8ABD99124557341B9809B62A639957B166C2A7EFEA0A042BE2D753464DF5908DF4F5FE01A91C239B744CD44A70B79EF81048
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......&:..b[.Lb[.Lb[.Lk#sLd[.Lw$.M`[.L)#.Ma[.Lb[.LI[.Lw$.Mn[.Lw$.Mj[.Lw$.Ma[.LX..Mg[.LX..Mc[.LX..Lc[.LX..Mc[.LRichb[.L........................PE..d...R..e.........." ...%.n..........`.....................................................`..........................................p..d...tq..d...............0...............4...@Z...............................Y..@...............(............................text....l.......n.................. ..`.rdata...............r..............@..@.data................j..............@....pdata..0............r..............@..@.rsrc...............................@..@.reloc..4...........................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome\PublicKey\_ed25519.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):27648
                                                                                                                                                                                                                          Entropy (8bit):5.792776923715812
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:mBwi/rOF26VZW1n0n/Is42g9qhrnW0mvPauYhz35sWJftjb1Ddsla15gkbQ0e1:cL/g28Ufsxg9GmvPauYLxtX1D8kf
                                                                                                                                                                                                                          MD5:717DA232A3A9F0B94AF936B30B59D739
                                                                                                                                                                                                                          SHA1:F1B3676E708696585FBCB742B863C5BB913D923F
                                                                                                                                                                                                                          SHA-256:B3FD73D54079903C0BE39BA605ED9BB58ECD1D683CCB8821D0C0CC795165B0C6
                                                                                                                                                                                                                          SHA-512:7AF46035F9D4A5786ED3CE9F97AC33637C3428EF7183DED2AFD380265FAE6969BB057E3B5D57C990DD083A9DB2A67BEA668D4215E78244D83D7EE7E0A7B40143
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..........)......................................R......R......RE.....R.....Rich...........PE..d...R..e.........." ...%.F...(......P.....................................................`..........................................j..0....k..d...............................,...pc..............................0b..@............`...............................text...xD.......F.................. ..`.rdata.."....`.......J..............@..@.data................\..............@....pdata...............d..............@..@.rsrc................h..............@..@.reloc..,............j..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome\PublicKey\_ed448.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):67072
                                                                                                                                                                                                                          Entropy (8bit):6.060435635420756
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:1536:YqctkGACFI5t35q2JbL0UbkrwwOoKXyMH1B7M9rMdccdWxROpq:YqctkGACFI5t35q2JbgrwwOoqLTM9rMq
                                                                                                                                                                                                                          MD5:ADF96805C070920EA90D9AB4D1E35807
                                                                                                                                                                                                                          SHA1:D8FA8E29D9CDCD678DC03DA527EAF2F0C3BEF21A
                                                                                                                                                                                                                          SHA-256:A36B1EDC104136E12EB6F28BD9366D30FFCEC0434684DC139314723E9C549FB7
                                                                                                                                                                                                                          SHA-512:FB67C1F86CF46A63DF210061D16418589CD0341A6AA75AB49F24F99AD3CFF874BB02664706B9E2C81B7EF7300AF5BB806C412B4F069D22B72F7D9EBFFF66FE61
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......N4.|.U./.U./.U./.-a/.U./.*...U./A-...U./.U./!U./.*...U./.*...U./.*...U./0....U./0....U./0../.U./0....U./Rich.U./................PE..d...S..e.........." ...%.....8......`........................................@............`.........................................`...h.......d.... .......................0..,.......................................@............................................text............................... ..`.rdata..*...........................@..@.data...............................@....pdata..............................@..@.rsrc........ ......................@..@.reloc..,....0......................@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome\PublicKey\_x25519.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):10752
                                                                                                                                                                                                                          Entropy (8bit):4.488514144301916
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:IpVVdJvbrqTu6ZdpvY0IluLfcC75JiC4cs89EfqADBhDTAbcX6gn/7EC:uVddiT7pgTctdErDDDTicqgn/7
                                                                                                                                                                                                                          MD5:148E1600E9CBAF6702D62D023CAC60BC
                                                                                                                                                                                                                          SHA1:4CDD8445408C4165B6E029B9966C71BC45E634A2
                                                                                                                                                                                                                          SHA-256:1461AAFD4B9DC270128C89C3EB5358794C77693BB943DC7FC42AA3BB0FC52B16
                                                                                                                                                                                                                          SHA-512:53155DA3FD754AF0BC30E2A51F0B579B8A83A772025CE0B4AFD01A31B8A40F46533FDA9CC3D0D32E9480DBBD7DD4A28F9DAAC11A370B0435E5E74666ACF9181C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6...r.h.r.h.r.h.{...p.h.g.i.p.h.9.i.q.h.r.i.V.h.g.m.y.h.g.l.z.h.g.k.q.h.H.`.s.h.H.h.s.h.H...s.h.H.j.s.h.Richr.h.........................PE..d...R..e.........." ...%............P........................................p............`..........................................'..P...0(..P....P.......@...............`..,...P#..............................."..@............ ...............................text............................... ..`.rdata....... ......................@..@.data...8....0......."..............@....pdata.......@.......$..............@..@.rsrc........P.......&..............@..@.reloc..,....`.......(..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome\Util\_cpuid_c.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):10240
                                                                                                                                                                                                                          Entropy (8bit):4.731194408014124
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:lJVVdJvbrqTu6ZdpvY0IluLfcC75JiCKs89EVAElIijKDQGybMZYJWJcX6gbW6s:JVddiT7pgTctEEaEDKDuMCWJcqgbW6
                                                                                                                                                                                                                          MD5:1547F8CB860AB6EA92B85D4C1B0209A1
                                                                                                                                                                                                                          SHA1:C5AE217DEE073AC3D23C3BF72EE26D4C7515BD88
                                                                                                                                                                                                                          SHA-256:1D2F3E627551753E58ED9A85F8D23716F03B51D8FB5394C4108EB1DC90DC9185
                                                                                                                                                                                                                          SHA-512:40F0B46EE837E4568089D37709EF543A987411A17BDBAE93D8BA9F87804FB34DCA459A797629F34A5B3789B4D89BD46371AC4F00DDFE5D6B521DEA8DC2375115
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6...r.`.r.`.r.`.{...p.`.g.a.p.`.9.a.q.`.r.a.Q.`.g.e.y.`.g.d.z.`.g.c.q.`.H.h.s.`.H.`.s.`.H...s.`.H.b.s.`.Richr.`.................PE..d...N..e.........." ...%............P........................................p............`..........................................'..|....'..P....P.......@...............`..,...."...............................!..@............ ...............................text............................... ..`.rdata....... ......................@..@.data...8....0....... ..............@....pdata.......@......."..............@..@.rsrc........P.......$..............@..@.reloc..,....`.......&..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\Cryptodome\Util\_strxor.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):10240
                                                                                                                                                                                                                          Entropy (8bit):4.686131723746002
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:EiZVVdJvbrqTu6ZdpvY0IluLfcC75JiCKs89EMz3DmWMoG4BcX6gbW6O:HVddiT7pgTctEEO3DcoHcqgbW6
                                                                                                                                                                                                                          MD5:16F42DE194AAEFB2E3CDEE7FA63D2401
                                                                                                                                                                                                                          SHA1:BE2AB72A90E0342457A9D13BE5B6B1984875EDEA
                                                                                                                                                                                                                          SHA-256:61E23970B6CED494E11DC9DE9CB889C70B7FF7A5AFE5242BA8B29AA3DA7BC60E
                                                                                                                                                                                                                          SHA-512:A671EA77BC8CA75AEDB26B73293B51B780E26D6B8046FE1B85AE12BC9CC8F1D2062F74DE79040AD44D259172F99781C7E774FE40768DC0A328BD82A48BF81489
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6...r.`.r.`.r.`.{...p.`.g.a.p.`.9.a.q.`.r.a.Q.`.g.e.y.`.g.d.z.`.g.c.q.`.H.h.s.`.H.`.s.`.H...s.`.H.b.s.`.Richr.`.................PE..d...P..e.........." ...%............P........................................p............`.........................................`'..t....'..P....P.......@...............`..,...."...............................!..@............ ...............................text...x........................... ..`.rdata....... ......................@..@.data...8....0....... ..............@....pdata.......@......."..............@..@.rsrc........P.......$..............@..@.reloc..,....`.......&..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\PIL\_imaging.cp311-win_amd64.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):2341888
                                                                                                                                                                                                                          Entropy (8bit):6.5065928437689475
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:49152:29Q79HlVQQ/ptaWa1f6yWKEPsoU0lP0h:3HI7fbEPsoU0y
                                                                                                                                                                                                                          MD5:B726A47FEDC2F10FC6AD3C040A9B1188
                                                                                                                                                                                                                          SHA1:ACF2D39739CDA8EF314E0889924A39CA0CDF5CCE
                                                                                                                                                                                                                          SHA-256:EAAD1713DBCAE6191B925A12CE4065DE247ABBC06B8B1E6B36093B38D8703B29
                                                                                                                                                                                                                          SHA-512:3E1FFE28AA95556E14C60FF517BBE44C164CA030A836D39446E61BDDCD2D8F39231B551A5E6D800289D28A259767694594484887026F2803408F12D1EA363FDE
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.......................o.....W[......W[......W[......W[......W[.......Y..............................\.......\.......\.......\.......\......Rich............................PE..d....I.f.........." ...(.............{.......................................0$...........`.........................................05".`....5".......$.......#...............$.....0. ....................... .(..... .@............@..(............................text....,.......................... ..`.rdata..$....@.......2..............@..@.data........`"..b...D".............@....pdata........#.......".............@..@.rsrc.........$.......#.............@..@.reloc........$.......#.............@..B........................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\PIL\_imagingcms.cp311-win_amd64.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):263168
                                                                                                                                                                                                                          Entropy (8bit):6.278905574145053
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6144:KdcKQcsu5mV6SGRI7O9hHTnLg9uP1+74/LgHmPr9qvZqhLaHLTLrLfqeqwLfp694:KdOcvm8hHTnLg9uP1+74/LgHmPr9qvZx
                                                                                                                                                                                                                          MD5:F5F4E931731BEA017E78CDCA6E038C7F
                                                                                                                                                                                                                          SHA1:92BECFCFB2D37B98BEC87ABFACC70A9769BA7F70
                                                                                                                                                                                                                          SHA-256:08F2DCCC7FDC49B641FD234BD13C6F5237D236AB7A3B3CA26B30CD5012154AB7
                                                                                                                                                                                                                          SHA-512:82F427B95227ADEF6CD2BD8533E01CA4AB2761F914150E30DE5E2BDBCB33BD6D543A4F965918E331C4767C9E7747C29930F1E013EE45574C012016A8D41C448D
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......5.}.qh..qh..qh..x....h.....sh.....uh.....yh.....|h......sh..:...vh..qh...h..b...gh..b...ph..b...ph..b...ph..Richqh..........PE..d....I.f.........." ...(....."...............................................@............`......................................... ...h............ .........../...........0.......`..............................._..@...............`............................text...X........................... ..`.rdata.............................@..@.data....>.......:..................@....pdata.../.......0..................@..@.rsrc........ ......................@..@.reloc.......0......................@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\PIL\_imagingmath.cp311-win_amd64.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):24064
                                                                                                                                                                                                                          Entropy (8bit):5.630145214999331
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:JYwU58xEr4Pp/zosXo1USBOaD5p7l1rFXckOgaUJI:JYp8mrszoT1USsq1rNc+aT
                                                                                                                                                                                                                          MD5:04FA6E0FB34ED332583F5D9E049B04A2
                                                                                                                                                                                                                          SHA1:81147863EBB39350FACED61729C9BFCBA9A78EC9
                                                                                                                                                                                                                          SHA-256:E3F179BB353106B74FD3259595F2D2D3BB1207E4931DA594ED4DF72D4AC98196
                                                                                                                                                                                                                          SHA-512:9F191E6410DBCAF8D325878DD9319464C68AC476620E34CD02B957556BE7670407729CD6843574EB9F37E6B287C4F3AAEC62BF9A9C20E5F3FCAF119EB132F9CB
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......f...".".".+...&..a.. .i... ..a..!..a..*..a....Mc..!."...1f..#.1f..#.1fo.#.1f..#.Rich".........................PE..d....I.f.........." ...(.6...*......p8....................................................`.........................................@`..h....`..x...............8...............@....U...............................S..@............P..`............................text...X4.......6.................. ..`.rdata.......P.......:..............@..@.data...P....p.......P..............@....pdata..8............R..............@..@.rsrc................Z..............@..@.reloc..@............\..............@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\PIL\_imagingtk.cp311-win_amd64.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):14848
                                                                                                                                                                                                                          Entropy (8bit):5.058731186917024
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:OGrzuZtIEeElbMdd0Fyd3KE+2iV3Ww2AXs9CoLckgTN2T:HuZgEagyPVS2AXXo7gTN2
                                                                                                                                                                                                                          MD5:DDC5D5270757717F698FC06DCB76032B
                                                                                                                                                                                                                          SHA1:C35D0212284DA2E0ABFEF99C63C116010945D11A
                                                                                                                                                                                                                          SHA-256:8CC471F2F167E5EDA1398373EEB7C6689420DA308D50771745ABDED73EEE7EEF
                                                                                                                                                                                                                          SHA-512:81A74A48958C921ABB648BBA700042CBAC5669DF4F9118F1102A020DC9B101DE7E2C1E1022BA526B0D830BFA8AC30EC037F449784E24F90CACE2CC7B86ED7A30
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........>B.mmB.mmB.mmK..mH.mm.3ll@.mm.3nlA.mm.3ilJ.mm.3hlN.mm-1ll@.mm..llG.mmB.lmv.mmQ4el@.mmQ4mlC.mmQ4.mC.mmQ4olC.mmRichB.mm................PE..d....I.f.........." ...(.....$......0.....................................................`..........................................;..d....<.......p.......`..................<...`5.............................. 4..@............0...............................text...h........................... ..`.rdata.......0......................@..@.data...X....P.......0..............@....pdata.......`.......2..............@..@.rsrc........p.......6..............@..@.reloc..<............8..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\PIL\_webp.cp311-win_amd64.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):412672
                                                                                                                                                                                                                          Entropy (8bit):6.529285441982242
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6144:62/DU54t1cEXIIuG9Bq9lCsJBbYQBPexnCODrp7H2QcGz8uijr:62Qut17XtuG69bY65OQQcFumr
                                                                                                                                                                                                                          MD5:CDA7EED01BEFD363C17F042727B6184A
                                                                                                                                                                                                                          SHA1:5FD1FCCE15B2277B6B02985E54724DAF04467B18
                                                                                                                                                                                                                          SHA-256:5AAD99A74F8C37855C98948E2F5495A07750891CB907267FB34620373E2655C4
                                                                                                                                                                                                                          SHA-512:9FB70085DA3074A8C9DA0C454E721B0C6D94B4395F011CB342D698B3DD74EBC2F960B2BFA85B84B0E912B3A51F226DA2B4C362D9A7DCAAC56951126D4D61535E
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......:7|.~V..~V..~V..w...tV......|V..5...|V......zV......vV......sV......}V..~V..)V..m...)V..m....V..m....V..m...V..m....V..Rich~V..................PE..d....I.f.........." ...(.....^............................................................`.............................................\....................`...<..................p...............................0...@............0...............................text............................... ..`.rdata.......0......................@..@.data....2... ......................@....pdata...<...`...>..................@..@.rsrc................H..............@..@.reloc...............J..............@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\Pythonwin\mfc140u.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):5653424
                                                                                                                                                                                                                          Entropy (8bit):6.729277267882055
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:49152:EuEsNcEc8/CK4b11P5ViH8gw0+NVQD5stWIlE7lva8iposS9j5fzSQzs7ID+AVuS:EnL8+5fiEnQFLOAkGkzdnEVomFHKnPS
                                                                                                                                                                                                                          MD5:03A161718F1D5E41897236D48C91AE3C
                                                                                                                                                                                                                          SHA1:32B10EB46BAFB9F81A402CB7EFF4767418956BD4
                                                                                                                                                                                                                          SHA-256:E06C4BD078F4690AA8874A3DEB38E802B2A16CCB602A7EDC2E077E98C05B5807
                                                                                                                                                                                                                          SHA-512:7ABCC90E845B43D264EE18C9565C7D0CBB383BFD72B9CEBB198BA60C4A46F56DA5480DA51C90FF82957AD4C84A4799FA3EB0CEDFFAA6195F1315B3FF3DA1BE47
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Q.cu...&...&...&...'...&...'...&...'...&..&...&G..'...&G..'...&...'...&...&..&G..'...&G..'...&G..'...&G..'...&G..&...&G..'...&Rich...&................PE..d....~.a.........." .....(-..X)......X,.......................................V......YV...`A..........................................:.....h.;.......?......`=..8....V..'...PU.0p..p.5.T...........................`...8............@-.P...0.:......................text....&-......(-................. ..`.rdata.......@-......,-.............@..@.data....6... <.......<.............@....pdata...8...`=..:....<.............@..@.didat..H.....?.......?.............@....rsrc.........?.......?.............@..@.reloc..0p...PU..r....T.............@..B................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\Pythonwin\win32ui.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1143296
                                                                                                                                                                                                                          Entropy (8bit):6.042100978272984
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:+jUcbgAIjeB47XV6LMDANfo4KR0fpCTuWpG0LwP8Ehzf3N:+DbOG47X3ANfoNnTt40TEhL3
                                                                                                                                                                                                                          MD5:0E96B5724C2213300864CEB36363097A
                                                                                                                                                                                                                          SHA1:151931D9162F9E63E8951FC44A9B6D89AF7AF446
                                                                                                                                                                                                                          SHA-256:85CF3081B0F1ADAFDBDCF164D7788A7F00E52BACDF02D1505812DE4FACFC962F
                                                                                                                                                                                                                          SHA-512:46E8FEE7B12F061EA8A7AB0CD4A8E683946684388498D6117AFC404847B9FBB0A16DC0E5480609B1352DF8F61457DCDBDA317248CA81082CC4F30E29A3242D3B
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........k.N..~...~...~..r....~.v.....~..a....~...z...~...}...~...{...~.......~.......~.v.w...~.v.~...~.v.....~.v.|...~.Rich..~.........................PE..d......d.........." .........r......T.....................................................`.........................................@....T..Hr..h...............................p\..p...T.......................(......8................0...........................text............................... ..`.rdata..f...........................@..@.data...............................@....pdata...............d..............@..@.rsrc...............................@..@.reloc..p\.......^..................@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\VCRUNTIME140.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):109392
                                                                                                                                                                                                                          Entropy (8bit):6.641929675972235
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:1536:GcghbEGyzXJZDWnEzWG9q4lVOiVgXjO5/woecbq8qZHg2zuCS+zuecL:GV3iC0h9q4v6XjKwoecbq8qBTq+1cL
                                                                                                                                                                                                                          MD5:4585A96CC4EEF6AAFD5E27EA09147DC6
                                                                                                                                                                                                                          SHA1:489CFFF1B19ABBEC98FDA26AC8958005E88DD0CB
                                                                                                                                                                                                                          SHA-256:A8F950B4357EC12CFCCDDC9094CCA56A3D5244B95E09EA6E9A746489F2D58736
                                                                                                                                                                                                                          SHA-512:D78260C66331FE3029D2CC1B41A5D002EC651F2E3BBF55076D65839B5E3C6297955AFD4D9AB8951FBDC9F929DBC65EB18B14B59BCE1F2994318564EB4920F286
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........u...u...u.E.t...u.....u...t...u..v...u..q...u..p...u..u...u......u..w...u.Rich..u.........PE..d..._#;..........." ...".....`......................................................=.....`A........................................`C..4....K...............p.......\..PO...........-..p............................,..@............................................text............................... ..`.rdata...A.......B..................@..@.data...0....`.......D..............@....pdata.......p.......H..............@..@_RDATA..\............T..............@..@.rsrc................V..............@..@.reloc...............Z..............@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\VCRUNTIME140_1.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):49520
                                                                                                                                                                                                                          Entropy (8bit):6.65700274508223
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:YEgYXUcHJcUJSDW/tfxL1qBSHGm6Ub/I2Hi09z0XQKBcRmuU9zuKl:YvGS8fZ1esJwUpz0X3B+d8zuKl
                                                                                                                                                                                                                          MD5:7E668AB8A78BD0118B94978D154C85BC
                                                                                                                                                                                                                          SHA1:DBAC42A02A8D50639805174AFD21D45F3C56E3A0
                                                                                                                                                                                                                          SHA-256:E4B533A94E02C574780E4B333FCF0889F65ED00D39E32C0FBBDA2116F185873F
                                                                                                                                                                                                                          SHA-512:72BB41DB17256141B06E2EAEB8FC65AD4ABDB65E4B5F604C82B9E7E7F60050734137D602E0F853F1A38201515655B6982F2761EE0FA77C531AA58591C95F0032
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............L...L...L...M...L...M...L.FL...L...L...L...M...L...M...L...M...L...M...L..*L...L...M...LRich...L........................PE..d....J.$.........." ...".<...8.......A....................................................`A........................................0m.......m..x....................r..pO......D....c..p...........................pb..@............P..h............................text...0:.......<.................. ..`.rdata..."...P...$...@..............@..@.data................d..............@....pdata...............f..............@..@.rsrc................l..............@..@.reloc..D............p..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\_asyncio.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):65304
                                                                                                                                                                                                                          Entropy (8bit):6.186523609819811
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:1536:k2icaMc907zrzE6+gTKnEzhIVOnZC7SyMx6:k2icrc4HE6+gTOEzhIVOn0j
                                                                                                                                                                                                                          MD5:CEE78DC603D57CB2117E03B2C0813D84
                                                                                                                                                                                                                          SHA1:095C98CA409E364B8755DC9CFD12E6791BF6E2B8
                                                                                                                                                                                                                          SHA-256:6306BE660D87FFB2271DD5D783EE32E735A792556E0B5BD672DC0B1C206FDADC
                                                                                                                                                                                                                          SHA-512:7258560AA557E3E211BB9580ADD604B5191C769594E17800B2793239DF45225A82CE440A6B9DCF3F2228ED84712912AFFE9BF0B70B16498489832DF2DEE33E7E
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......B:'T.[I..[I..[I..#...[I..'H..[I..'L..[I..'M..[I..'J..[I..&H..[I.M#H..[I..[H..[I..&D..[I..&I..[I..&...[I..&K..[I.Rich.[I.........PE..d......e.........." ...#.R..........`.....................................................`.............................................P...`...d......................../..........`w..T........................... v..@............p...............................text....P.......R.................. ..`.rdata..~J...p...L...V..............@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\_bz2.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):84760
                                                                                                                                                                                                                          Entropy (8bit):6.56801864004604
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:1536:7/Uez7qlMjca6uPZLPYMPHn3m8bhztpIVCVC7SyhJDxhy:4ezGC4TM/3RbhhpIVCVCXpy
                                                                                                                                                                                                                          MD5:28EDE9CE9484F078AC4E52592A8704C7
                                                                                                                                                                                                                          SHA1:BCF8D6FE9F42A68563B6CE964BDC615C119992D0
                                                                                                                                                                                                                          SHA-256:403E76FE18515A5EA3227CF5F919AA2F32AC3233853C9FB71627F2251C554D09
                                                                                                                                                                                                                          SHA-512:8C372F9F6C4D27F7CA9028C6034C17DEB6E98CFEF690733465C1B44BD212F363625D9C768F8E0BD4C781DDDE34EE4316256203ED18FA709D120F56DF3CCA108B
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......w.l.3...3...3...:...9......1......0......>......;......7.......0...x...1...3...l.......;.......2.......2.......2...Rich3...................PE..d......e.........." ...#.....^..............................................P.......U....`.........................................p...H............0....... .. ......../...@..........T...........................p...@............................................text............................... ..`.rdata..L>.......@..................@..@.data...............................@....pdata.. .... ......................@..@.rsrc........0......................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\_cffi_backend.cp311-win_amd64.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):181248
                                                                                                                                                                                                                          Entropy (8bit):6.186854863391558
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3072:nmHfhrWGYV6sewRdFRId6PBNKcqDn/C1j/UyS7viSTLkKxalPu//ay/i:nmprWX6sPRNPBAn/0/dCiSTLL0P2/ay
                                                                                                                                                                                                                          MD5:210DEF84BB2C35115A2B2AC25E3FFD8F
                                                                                                                                                                                                                          SHA1:0376B275C81C25D4DF2BE4789C875B31F106BD09
                                                                                                                                                                                                                          SHA-256:59767B0918859BEDDF28A7D66A50431411FFD940C32B3E8347E6D938B60FACDF
                                                                                                                                                                                                                          SHA-512:CD5551EB7AFD4645860C7EDD7B0ABD375EE6E1DA934BE21A6099879C8EE3812D57F2398CAD28FBB6F75BBA77471D9B32C96C7C1E9D3B4D26C7FC838745746C7F
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........ ..MA.CMA.CMA.CD9MCAA.C.4.BOA.C+.#CIA.C.4.BFA.C.4.BEA.C.4.BIA.C.9.BIA.C.=.BNA.CMA.C.A.C.4.BIA.CD9KCLA.C.4.BLA.C.4!CLA.C.4.BLA.CRichMA.C........................PE..d...,..e.........." .........@..............................................0............`..........................................g..l...|g..................<............ .......M...............................M..8............................................text............................... ..`.rdata..l...........................@..@.data....\.......0...v..............@....pdata..<...........................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\_ctypes.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):123672
                                                                                                                                                                                                                          Entropy (8bit):6.0601189161591
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3072:aS7u5LnIxdP3fPHW+QfLIrAYKpemW9IVLPjo:aSw+3FQfLIrIemW3
                                                                                                                                                                                                                          MD5:22C4892CAF560A3EE28CF7F210711F9E
                                                                                                                                                                                                                          SHA1:B30520FADD882B667ECEF3B4E5C05DC92E08B95A
                                                                                                                                                                                                                          SHA-256:E28D4E46E5D10B5FDCF0292F91E8FD767E33473116247CD5D577E4554D7A4C0C
                                                                                                                                                                                                                          SHA-512:EDB86B3694FFF0B05318DECF7FC42C20C348C1523892CCE7B89CC9C5AB62925261D4DD72D9F46C9B2BDA5AC1E6B53060B8701318B064A286E84F817813960B19
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.....................).....).....).....).....O...............W.......c.O.....O.....O.o...O.....Rich..........................PE..d......e.........." ...#............p\..............................................jh....`.........................................pP.......P.........................../..............T...........................`...@............................................text............................... ..`.rdata...l.......n..................@..@.data...$=...p...8...^..............@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\_decimal.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):253720
                                                                                                                                                                                                                          Entropy (8bit):6.551075270762715
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6144:cjz3B48pj9aOtoQdpJOsoTiSi9qWM53pLW1Atp6tQh7:i94uj9afQVrom0bUQh7
                                                                                                                                                                                                                          MD5:BAAA9067639597E63B55794A757DDEFF
                                                                                                                                                                                                                          SHA1:E8DD6B03EBEF0B0A709E6CCCFF0E9F33C5142304
                                                                                                                                                                                                                          SHA-256:6CD52B65E11839F417B212BA5A39F182B0151A711EBC7629DC260B532391DB72
                                                                                                                                                                                                                          SHA-512:7995C3B818764AD88DB82148EA0CE560A0BBE9594CA333671B4C5E5C949F5932210EDBD63D4A0E0DC2DAF24737B99318E3D5DAAEE32A5478399A6AA1B9EE3719
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........@.R.!...!...!...Y=..!..+]...!..+]...!..+]...!..+]...!..M\...!...Y...!...!...!..M\...!..M\...!..M\...!..M\Q..!..M\...!..Rich.!..........PE..d......e.........." ...#.x...<......<...............................................:.....`......................................... T..P...pT..................$'......./......P.......T...........................P...@............................................text....v.......x.................. ..`.rdata..l............|..............@..@.data....*...p...$...T..............@....pdata..$'.......(...x..............@..@.rsrc...............................@..@.reloc..P...........................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\_hashlib.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):65304
                                                                                                                                                                                                                          Entropy (8bit):6.2555709687934655
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:1536:jfKlbLgy209/MkZy6n23JZlnvy7OjZophIVOIi7SyMrxZR1:7Khgy+XZla7OjSphIVOIiKR1
                                                                                                                                                                                                                          MD5:C888ECC8298C36D498FF8919CEBDB4E6
                                                                                                                                                                                                                          SHA1:F904E1832B9D9614FA1B8F23853B3E8C878D649D
                                                                                                                                                                                                                          SHA-256:21D59958E2AD1B944C4811A71E88DE08C05C5CA07945192AB93DA5065FAC8926
                                                                                                                                                                                                                          SHA-512:7161065608F34D6DE32F2C70B7485C4EE38CD3A41EF68A1BEACEE78E4C5B525D0C1347F148862CF59ABD9A4AD0026C2C2939736F4FC4C93E6393B3B53AA7C377
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........(t..F'..F'..F'..'..F'u.G&..F'u.C&..F'u.B&..F'u.E&..F'..G&..F'..G&..F'..G'B.F'..K&..F'..F&..F'...'..F'..D&..F'Rich..F'................PE..d......e.........." ...#.T...~......@@..............................................H.....`............................................P... ............................/......X...P}..T............................|..@............p..0............................text....S.......T.................. ..`.rdata...O...p...P...X..............@..@.data...8...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..X...........................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\_lzma.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):159000
                                                                                                                                                                                                                          Entropy (8bit):6.849076584495919
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3072:cNltLBrdV/REWa/g7Lznf49mNoiUMApqlpIVZ1SXW:cNltPpREgAYOicMI
                                                                                                                                                                                                                          MD5:D386B7C4DCF589E026ABFC7196CF1C4C
                                                                                                                                                                                                                          SHA1:C07CE47CE0E69D233C5BDD0BCAC507057D04B2D4
                                                                                                                                                                                                                          SHA-256:AD0440CA6998E18F5CC917D088AF3FEA2C0FF0FEBCE2B5E2B6C0F1370F6E87B1
                                                                                                                                                                                                                          SHA-512:78D79E2379761B054DF1F9FD8C5B7DE5C16B99AF2D2DE16A3D0AC5CB3F0BD522257579A49E91218B972A273DB4981F046609FDCF2F31CF074724D544DAC7D6C8
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........T"#.5Lp.5Lp.5Lp.M.p.5Lp.IMq.5Lp.IIq.5Lp.IHq.5Lp.IOq.5LpnHMq.5Lp.MMq.5Lp.5Mp.5LpnHAq.5LpnHLq.5LpnH.p.5LpnHNq.5LpRich.5Lp................PE..d......e.........." ...#.b...........5....................................................`..........................................%..L...\%..x....p.......P.......>.../......8.......T...........................p...@............................................text...na.......b.................. ..`.rdata..............f..............@..@.data........@......................@....pdata.......P......................@..@.rsrc........p.......2..............@..@.reloc..8............<..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\_multiprocessing.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):34584
                                                                                                                                                                                                                          Entropy (8bit):6.408696570061904
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:n7I6Rwcl5w5zu8TdywGnJjRIVWtTk5YiSyvE+OAMxkEO:7Ikl5kzu8TdywGJjRIVWtTu7Sy18xK
                                                                                                                                                                                                                          MD5:622A0E73779C88FC430B69CAF4A39789
                                                                                                                                                                                                                          SHA1:F6536137E4E2CD8EC181F09B7DBA5E2E4D03B392
                                                                                                                                                                                                                          SHA-256:EDFA9EE414F41448F8FFABB79F3BB8DB5C25E1CFD28FACF88EB5FE2D1E1D7551
                                                                                                                                                                                                                          SHA-512:FD8D6DB53B630821845DFE22B09C4335565F848A421AF271797EFE272BAAA1EF887D735D4D5CD7D1258F2DD8F523327A67C071F7D16FC1BF53ACA39BAE41DFF2
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-*.yCy.yCy.yCy...y.yCy'.Bx.yCy'.Fx.yCy'.Gx.yCy'.@x.yCyA.Bx.yCy.yBy.yCy..Bx.yCyA.Nx.yCyA.Cx.yCyA..y.yCyA.Ax.yCyRich.yCy................PE..d......e.........." ...#.....<......0...............................................E.....`.........................................0D..`....D..x....p.......`.......X.../...........4..T...........................p3..@............0...............................text............................... ..`.rdata..^....0... ..."..............@..@.data........P.......B..............@....pdata.......`.......H..............@..@.rsrc........p.......L..............@..@.reloc...............V..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\_overlapped.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):50968
                                                                                                                                                                                                                          Entropy (8bit):6.434106091606417
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:R1FMCcP4W9vqJKRJs2lNXSkCirb1IVXtW5YiSyvw5AMxkEfEk:R1FMaJKWkCg1IVXts7Sy4hxjEk
                                                                                                                                                                                                                          MD5:D3BE208DC5388225162B6F88FF1D4386
                                                                                                                                                                                                                          SHA1:8EFFDB606B6771D5FDF83145DE0F289E8AD83B69
                                                                                                                                                                                                                          SHA-256:CE48969EBEBDC620F4313EBA2A6B6CDA568B663C09D5478FA93826D401ABE674
                                                                                                                                                                                                                          SHA-512:9E1C3B37E51616687EECF1F7B945003F6EB4291D8794FEA5545B4A84C636007EB781C18F6436039DF02A902223AC73EFAC9B2E44DDC8594DB62FEB9997475DA3
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........}!{..O(..O(..O(.d.(..O(W`N)..O(W`J)..O(W`K)..O(W`L)..O(1aN)..O(..N(..O(.dN)..O(.dK)..O(1aB)..O(1aO)..O(1a.(..O(1aM)..O(Rich..O(................PE..d......e.........." ...#.B...X.......................................................N....`.........................................0...X................................/......,....f..T...........................Pe..@............`...............................text...fA.......B.................. ..`.rdata..$5...`...6...F..............@..@.data................|..............@....pdata..............................@..@.rsrc...............................@..@.reloc..,...........................@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\_queue.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):32536
                                                                                                                                                                                                                          Entropy (8bit):6.447318282610391
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:P0+yFg6rXtUmxU99IVQUT5YiSyvyxAMxkE44:c+wRXiWU99IVQUd7Sy+xE4
                                                                                                                                                                                                                          MD5:50842CE7FCB1950B672D8A31C892A5D1
                                                                                                                                                                                                                          SHA1:D84C69FA2110B860DA71785D1DBE868BD1A8320F
                                                                                                                                                                                                                          SHA-256:06C36EC0749D041E6957C3CD7D2D510628B6ABE28CEE8C9728412D9CE196A8A2
                                                                                                                                                                                                                          SHA-512:C1E686C112B55AB0A5E639399BD6C1D7ADFE6AEDC847F07C708BEE9F6F2876A1D8F41EDE9D5E5A88AC8A9FBB9F1029A93A83D1126619874E33D09C5A5E45A50D
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......B:WX.[9..[9..[9..#...[9..'8..[9..'<..[9..'=..[9..':..[9..&8..[9.M#8..[9..[8.L[9..&4..[9..&9..[9..&...[9..&;..[9.Rich.[9.........PE..d......e.........." ...#.....8......................................................(F....`..........................................C..L....C..d....p.......`.......P.../..........p4..T...........................03..@............0..0............................text............................... ..`.rdata..R....0......................@..@.data...x....P.......<..............@....pdata.......`.......@..............@..@.rsrc........p.......D..............@..@.reloc...............N..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\_socket.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):79640
                                                                                                                                                                                                                          Entropy (8bit):6.28999572337647
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:1536:YJlhpHrTT9r3ujE9/s+S+pzpCoiTFVf7p9IVLwg7SyLxU:Y7hpL13ujE9/sT+pz4oYFVTp9IVLwgo
                                                                                                                                                                                                                          MD5:2C0EC225E35A0377AC1D0777631BFFE4
                                                                                                                                                                                                                          SHA1:7E5D81A06FF8317AF52284AEDCCAC6EBACE5C390
                                                                                                                                                                                                                          SHA-256:301C47C4016DAC27811F04F4D7232F24852EF7675E9A4500F0601703ED8F06AF
                                                                                                                                                                                                                          SHA-512:AEA9D34D9E93622B01E702DEFD437D397F0E7642BC5F9829754D59860B345BBDE2DD6D7FE21CC1D0397FF0A9DB4ECFE7C38B649D33C5C6F0EAD233CB201A73E0
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......f.+.".E.".E.".E.+...$.E...D. .E...@./.E...A.*.E...F.!.E...D. .E.".D...E.i.D.%.E...H.#.E...E.#.E....#.E...G.#.E.Rich".E.........................PE..d......e.........." ...#.l...........%.......................................P............`.............................................P............0....... ..x......../...@..........T...............................@............................................text...6k.......l.................. ..`.rdata...t.......v...p..............@..@.data...............................@....pdata..x.... ......................@..@.rsrc........0......................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\_sqlite3.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):120088
                                                                                                                                                                                                                          Entropy (8bit):6.2579260754206505
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3072:vvtiqaiN2oSNMAwwi3CLl147ZvV9NdrRvdO5yFAuaUVMJF8MYRnchIVOQ1B:HJaiN2oSNVDD5FJFr2
                                                                                                                                                                                                                          MD5:A70731AE2CA44B7292623AE8B0281549
                                                                                                                                                                                                                          SHA1:9E086C0753BB43E2876C33C4872E71808932A744
                                                                                                                                                                                                                          SHA-256:55344349F9199AEDAD1737A0311CBE2C3A4BF9494B76982520BACAD90F463C1B
                                                                                                                                                                                                                          SHA-512:8334104DF9837D32946965290BBC46BA0A0ADA17BD2D03FC63380979F5FC86B26BE245636718B4304DFD0D85A5B3F7170614F148E5C965CC5ADF59D34465F7F1
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........`.g...g...g.......g.......g.....g.......g.......g.......g..q....g.......g...g...f..q....g..q....g..q..g..q....g..Rich.g..........................PE..d......e.........." ...#............................................................ G....`..........................................Z..P....Z.........................../..............T...........................p...@............................................text............................... ..`.rdata..l...........................@..@.data................n..............@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\_ssl.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):176920
                                                                                                                                                                                                                          Entropy (8bit):5.955624236034285
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3072:pjIQQSFBfL+SiSVWuXa6XzfBJ9d41Olh59YL48PMrN/WgAlNcLpIVC72a:CSFNL3LJa6Xzj4BLcLP
                                                                                                                                                                                                                          MD5:66E78727C2DA15FD2AAC56571CD57147
                                                                                                                                                                                                                          SHA1:E93C9A5E61DB000DEE0D921F55F8507539D2DF3D
                                                                                                                                                                                                                          SHA-256:4727B60962EFACFD742DCA21341A884160CF9FCF499B9AFA3D9FDBCC93FB75D0
                                                                                                                                                                                                                          SHA-512:A6881F9F5827ACEB51957AAED4C53B69FCF836F60B9FC66EEB2ED84AED08437A9F0B35EA038D4B1E3C539E350D9D343F8A6782B017B10A2A5157649ABBCA9F9A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........U.+.4.x.4.x.4.x.L)x.4.x.H.y.4.x.H.y.4.x.H.y.4.x.H.y.4.xiI.y.4.x.4.x>5.x.L.y.4.xiI.y.4.xiI.y.4.xiIEx.4.xiI.y.4.xRich.4.x................PE..d......e.........." ...#............l+...............................................!....`.........................................0...d................................/......|...P...T...............................@............................................text............................... ..`.rdata...".......$..................@..@.data...............................@....pdata...............\..............@..@.rsrc................h..............@..@.reloc..|............r..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\_uuid.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):25368
                                                                                                                                                                                                                          Entropy (8bit):6.628339287223099
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:lCfwFpEWjfivQpIVZwobHQIYiSy1pCQFjzuAM+o/8E9VF0NySoJ:4qpEI4QpIVZwg5YiSyvgAMxkE7
                                                                                                                                                                                                                          MD5:3A09B6DB7E4D6FF0F74C292649E4BA96
                                                                                                                                                                                                                          SHA1:1A515F98946A4DCCC50579CBCEDF959017F3A23C
                                                                                                                                                                                                                          SHA-256:FC09E40E569F472DD4BA2EA93DA48220A6B0387EC62BB0F41F13EF8FAB215413
                                                                                                                                                                                                                          SHA-512:8D5EA9F7EEE3D75F0673CC7821A94C50F753299128F3D623E7A9C262788C91C267827C859C5D46314A42310C27699AF5CDFC6F7821DD38BF03C0B35873D9730F
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........<p.R#.R#.R#...#.R#i.S".R#i.W".R#i.V".R#i.Q".R#..S".R#..S".R#.S#..R#..Z".R#..R".R#...#.R#..P".R#Rich.R#........................PE..d......e.........." ...#.....&...... ........................................p............`.........................................`)..L....)..x....P.......@.......4.../...`..@...`#..T........................... "..@............ ..8............................text...h........................... ..`.rdata....... ......................@..@.data........0.......$..............@....pdata.......@.......&..............@..@.rsrc........P.......(..............@..@.reloc..@....`.......2..............@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\api-ms-win-core-console-l1-1-0.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):12240
                                                                                                                                                                                                                          Entropy (8bit):6.608323768366966
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:KFOWWthWzWf9BvVVWQ4mWqyVT/gqnajKsrCS81:uZWthWeN01IlGsrCt
                                                                                                                                                                                                                          MD5:07EBE4D5CEF3301CCF07430F4C3E32D8
                                                                                                                                                                                                                          SHA1:3B878B2B2720915773F16DBA6D493DAB0680AC5F
                                                                                                                                                                                                                          SHA-256:8F8B79150E850ACC92FD6AAB614F6E3759BEA875134A62087D5DD65581E3001F
                                                                                                                                                                                                                          SHA-512:6C7E4DF62EBAE9934B698F231CF51F54743CF3303CD758573D00F872B8ECC2AF1F556B094503AAE91100189C0D0A93EAF1B7CAFEC677F384A1D7B4FDA2EEE598
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d................." .........................................................0............`A........................................p...,............ ...................!..............p............................................................................rdata..d...........................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\api-ms-win-core-datetime-l1-1-0.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):11736
                                                                                                                                                                                                                          Entropy (8bit):6.6074868843808785
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:PUWthW6Wf9BvVVWQ4SWZifvXqnajJ6HNbLet:MWthW3NhXll6HZm
                                                                                                                                                                                                                          MD5:557405C47613DE66B111D0E2B01F2FDB
                                                                                                                                                                                                                          SHA1:DE116ED5DE1FFAA900732709E5E4EEF921EAD63C
                                                                                                                                                                                                                          SHA-256:913EAAA7997A6AEE53574CFFB83F9C9C1700B1D8B46744A5E12D76A1E53376FD
                                                                                                                                                                                                                          SHA-512:C2B326F555B2B7ACB7849402AC85922880105857C616EF98F7FB4BBBDC2CD7F2AF010F4A747875646FCC272AB8AA4CE290B6E09A9896CE1587E638502BD4BEFB
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d...p.~..........." .........................................................0............`A........................................p................ ...................!..............p............................................................................rdata..H...........................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\api-ms-win-core-debug-l1-1-0.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):11728
                                                                                                                                                                                                                          Entropy (8bit):6.622854484071805
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:tlWthWFWf9BvVVWQ4mWIzWLiP+CjAWqnajKsNb7:/WthWANnWLiP+CcWlGsNb7
                                                                                                                                                                                                                          MD5:624401F31A706B1AE2245EB19264DC7F
                                                                                                                                                                                                                          SHA1:8D9DEF3750C18DDFC044D5568E3406D5D0FB9285
                                                                                                                                                                                                                          SHA-256:58A8D69DF60ECBEE776CD9A74B2A32B14BF2B0BD92D527EC5F19502A0D3EB8E9
                                                                                                                                                                                                                          SHA-512:3353734B556D6EEBC57734827450CE3B34D010E0C033E95A6E60800C0FDA79A1958EBF9053F12054026525D95D24EEC541633186F00F162475CEC19F07A0D817
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d...YJ..........." .........................................................0.......s....`A........................................p................ ...................!..............p............................................................................rdata..T...........................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\api-ms-win-core-errorhandling-l1-1-0.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):11728
                                                                                                                                                                                                                          Entropy (8bit):6.670771733256744
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:1mxD3+HWthWiWf9BvVVWQ4WWuhD7DiqnajKswz3:19HWthWfN/GlGswz3
                                                                                                                                                                                                                          MD5:2DB5666D3600A4ABCE86BE0099C6B881
                                                                                                                                                                                                                          SHA1:63D5DDA4CEC0076884BC678C691BDD2A4FA1D906
                                                                                                                                                                                                                          SHA-256:46079C0A1B660FC187AAFD760707F369D0B60D424D878C57685545A3FCE95819
                                                                                                                                                                                                                          SHA-512:7C6E1E022DB4217A85A4012C8E4DAEE0A0F987E4FBA8A4C952424EF28E250BAC38B088C242D72B4641157B7CC882161AEFA177765A2E23AFCDC627188A084345
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d....^[..........." .........................................................0......@^....`A........................................p................ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\api-ms-win-core-file-l1-1-0.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):15328
                                                                                                                                                                                                                          Entropy (8bit):6.561472518225768
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:RaNYPvVX8rFTsoWthWgWf9BvVVWQ4SWfMaPOoI80Hy5qnajslBE87QyX:HPvVXqWthWlN2WlslEE87Qw
                                                                                                                                                                                                                          MD5:0F7D418C05128246AFA335A1FB400CB9
                                                                                                                                                                                                                          SHA1:F6313E371ED5A1DFFE35815CC5D25981184D0368
                                                                                                                                                                                                                          SHA-256:5C9BC70586AD538B0DF1FCF5D6F1F3527450AE16935AA34BD7EB494B4F1B2DB9
                                                                                                                                                                                                                          SHA-512:7555D9D3311C8622DF6782748C2186A3738C4807FC58DF2F75E539729FC4069DB23739F391950303F12E0D25DF9F065B4C52E13B2EBB6D417CA4C12CFDECA631
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d...*.;A.........." .........................................................@.......m....`A........................................p................0...................!..............p............................................................................rdata..<...........................@..@.rsrc........0......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\api-ms-win-core-file-l1-2-0.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):11728
                                                                                                                                                                                                                          Entropy (8bit):6.638884356866373
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:jlWaWthWAWf9BvVVWQ4WWloprVP+CjAWqnajKsNWqL:jIaWthWFNxtVP+CcWlGsNxL
                                                                                                                                                                                                                          MD5:5A72A803DF2B425D5AAFF21F0F064011
                                                                                                                                                                                                                          SHA1:4B31963D981C07A7AB2A0D1A706067C539C55EC5
                                                                                                                                                                                                                          SHA-256:629E52BA4E2DCA91B10EF7729A1722888E01284EED7DDA6030D0A1EC46C94086
                                                                                                                                                                                                                          SHA-512:BF44997C405C2BA80100EB0F2FF7304938FC69E4D7AE3EAC52B3C236C3188E80C9F18BDA226B5F4FDE0112320E74C198AD985F9FFD7CEA99ACA22980C39C7F69
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d...=+vj.........." .........................................................0.......N....`A........................................p...L............ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\api-ms-win-core-file-l2-1-0.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):11744
                                                                                                                                                                                                                          Entropy (8bit):6.744400973311854
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:imdzvQzEWthWwMVDEs3f0DHDsVBIwgmqvrnDD0ADEs3TDL2L4m2grMWaLN5DEs3r:v3WthWyWf9BvVVWQ4SWVVFJqqnajW2y
                                                                                                                                                                                                                          MD5:721B60B85094851C06D572F0BD5D88CD
                                                                                                                                                                                                                          SHA1:4D0EE4D717AEB9C35DA8621A545D3E2B9F19B4E7
                                                                                                                                                                                                                          SHA-256:DAC867476CAA42FF8DF8F5DFE869FFD56A18DADEE17D47889AFB69ED6519AFBF
                                                                                                                                                                                                                          SHA-512:430A91FCECDE4C8CC4AC7EB9B4C6619243AB244EE88C34C9E93CA918E54BD42B08ACA8EA4475D4C0F5FA95241E4AACB3206CBAE863E92D15528C8E7C9F45601B
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d..............." .........................................................0......T`....`A........................................p................ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\api-ms-win-core-handle-l1-1-0.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):11736
                                                                                                                                                                                                                          Entropy (8bit):6.638488013343178
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:frWthWFWf9BvVVWQ4SWNOfvXqnajJ6H4WJ:frWthWANRXll6H4WJ
                                                                                                                                                                                                                          MD5:D1DF480505F2D23C0B5C53DF2E0E2A1A
                                                                                                                                                                                                                          SHA1:207DB9568AFD273E864B05C87282987E7E81D0BA
                                                                                                                                                                                                                          SHA-256:0B3DFB8554EAD94D5DA7859A12DB353942406F9D1DFE3FAC3D48663C233EA99D
                                                                                                                                                                                                                          SHA-512:F14239420F5DD84A15FF5FCA2FAD81D0AA9280C566FA581122A018E10EBDF308AC0BF1D3FCFC08634C1058C395C767130C5ABCA55540295C68DF24FFD931CA0A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d.....(..........." .........................................................0......;.....`A........................................p...`............ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\api-ms-win-core-heap-l1-1-0.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):12256
                                                                                                                                                                                                                          Entropy (8bit):6.588267640761022
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:txlkWthW2Wf9BvVVWQ4SWBBBuUgxfzfqnaj0OTWv:txlkWthW7NkIrloFv
                                                                                                                                                                                                                          MD5:73433EBFC9A47ED16EA544DDD308EAF8
                                                                                                                                                                                                                          SHA1:AC1DA1378DD79762C6619C9A63FD1EBE4D360C6F
                                                                                                                                                                                                                          SHA-256:C43075B1D2386A8A262DE628C93A65350E52EAE82582B27F879708364B978E29
                                                                                                                                                                                                                          SHA-512:1C28CC0D3D02D4C308A86E9D0BC2DA88333DFA8C92305EC706F3E389F7BB6D15053040AFD1C4F0AA3383F3549495343A537D09FE882DB6ED12B7507115E5A263
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d....pi..........." .........................................................0............`A........................................p................ ...................!..............p............................................................................rdata..<...........................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\api-ms-win-core-interlocked-l1-1-0.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):11728
                                                                                                                                                                                                                          Entropy (8bit):6.678828474114903
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:4TWthWckWf9BvVVWQ4mWQAyUD7DiqnajKswzjdg:4TWthWcRNqGlGswzji
                                                                                                                                                                                                                          MD5:7C7B61FFA29209B13D2506418746780B
                                                                                                                                                                                                                          SHA1:08F3A819B5229734D98D58291BE4BFA0BEC8F761
                                                                                                                                                                                                                          SHA-256:C23FE8D5C3CA89189D11EC8DF983CC144D168CB54D9EAB5D9532767BCB2F1FA3
                                                                                                                                                                                                                          SHA-512:6E5E3485D980E7E2824665CBFE4F1619B3E61CE3BCBF103979532E2B1C3D22C89F65BCFBDDBB5FE88CDDD096F8FD72D498E8EE35C3C2307BACECC6DEBBC1C97F
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d....|............" .........................................................0.......3....`A........................................p................ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\api-ms-win-core-libraryloader-l1-1-0.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):12752
                                                                                                                                                                                                                          Entropy (8bit):6.602852377056617
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:Us13vuBL3B5LoWthW7Wf9BvVVWQ4mWgB7OQP+CjAWqnajKsN9arO:Us13vuBL3B2WthWmNVXP+CcWlGsN9P
                                                                                                                                                                                                                          MD5:6D0550D3A64BD3FD1D1B739133EFB133
                                                                                                                                                                                                                          SHA1:C7596FDE7EA1C676F0CC679CED8BA810D15A4AFE
                                                                                                                                                                                                                          SHA-256:F320F9C0463DE641B396CE7561AF995DE32211E144407828B117088CF289DF91
                                                                                                                                                                                                                          SHA-512:5DA9D490EF54A1129C94CE51349399B9012FC0D4B575AE6C9F1BAFCFCF7F65266F797C539489F882D4AD924C94428B72F5137009A851ECB541FE7FB9DE12FEB2
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d...]. ,.........." .........................................................0............`A........................................p................ ...................!..............p............................................................................rdata..X...........................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\api-ms-win-core-localization-l1-2-0.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):14800
                                                                                                                                                                                                                          Entropy (8bit):6.528059454770997
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:On2OMw3zdp3bwjGfue9/0jCRrndbZWWthWdNHhfVlGsSH:/OMwBprwjGfue9/0jCRrndbLEKv
                                                                                                                                                                                                                          MD5:1ED0B196AB58EDB58FCF84E1739C63CE
                                                                                                                                                                                                                          SHA1:AC7D6C77629BDEE1DF7E380CC9559E09D51D75B7
                                                                                                                                                                                                                          SHA-256:8664222823E122FCA724620FD8B72187FC5336C737D891D3CEF85F4F533B8DE2
                                                                                                                                                                                                                          SHA-512:E1FA7F14F39C97AAA3104F3E13098626B5F7CFD665BA52DCB2312A329639AAF5083A9177E4686D11C4213E28ACC40E2C027988074B6CC13C5016D5C5E9EF897B
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d...w............" .........................................................0............`A........................................p................ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\api-ms-win-core-memory-l1-1-0.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):12240
                                                                                                                                                                                                                          Entropy (8bit):6.659218747104705
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:2E+tWthWvWf9BvVVWQ4mWxHD7DiqnajKswzGIAf:T+tWthWiNcGlGswzLAf
                                                                                                                                                                                                                          MD5:721BAEA26A27134792C5CCC613F212B2
                                                                                                                                                                                                                          SHA1:2A27DCD2436DF656A8264A949D9CE00EAB4E35E8
                                                                                                                                                                                                                          SHA-256:5D9767D8CCA0FBFD5801BFF2E0C2ADDDD1BAAAA8175543625609ABCE1A9257BD
                                                                                                                                                                                                                          SHA-512:9FD6058407AA95058ED2FDA9D391B7A35FA99395EC719B83C5116E91C9B448A6D853ECC731D0BDF448D1436382EECC1FA9101F73FA242D826CC13C4FD881D9BD
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d...,OT..........." .........................................................0...........`A........................................p................ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\api-ms-win-core-namedpipe-l1-1-0.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):11728
                                                                                                                                                                                                                          Entropy (8bit):6.739082809754283
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:vdWthW8Wf9BvVVWQ4mWG2P+CjAWqnajKsNt:lWthWJNUP+CcWlGsNt
                                                                                                                                                                                                                          MD5:B3F887142F40CB176B59E58458F8C46D
                                                                                                                                                                                                                          SHA1:A05948ABA6F58EB99BBAC54FA3ED0338D40CBFAD
                                                                                                                                                                                                                          SHA-256:8E015CDF2561450ED9A0773BE1159463163C19EAB2B6976155117D16C36519DA
                                                                                                                                                                                                                          SHA-512:7B762319EC58E3FCB84B215AE142699B766FA9D5A26E1A727572EE6ED4F5D19C859EFB568C0268846B4AA5506422D6DD9B4854DA2C9B419BFEC754F547203F7E
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d...X.j..........." .........................................................0............`A........................................p................ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\api-ms-win-core-processenvironment-l1-1-0.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):12752
                                                                                                                                                                                                                          Entropy (8bit):6.601112204637961
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:GFPWthW5Wf9BvVVWQ4mWc0ZD7DiqnajKswzczr:GFPWthWsNiGlGswzq
                                                                                                                                                                                                                          MD5:89F35CB1212A1FD8FBE960795C92D6E8
                                                                                                                                                                                                                          SHA1:061AE273A75324885DD098EE1FF4246A97E1E60C
                                                                                                                                                                                                                          SHA-256:058EB7CE88C22D2FF7D3E61E6593CA4E3D6DF449F984BF251D9432665E1517D1
                                                                                                                                                                                                                          SHA-512:F9E81F1FEAB1535128B16E9FF389BD3DAAAB8D1DABF64270F9E563BE9D370C023DE5D5306DD0DE6D27A5A099E7C073D17499442F058EC1D20B9D37F56BCFE6D2
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d...ig............" .........................................................0......H.....`A........................................p...H............ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\api-ms-win-core-processthreads-l1-1-0.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):14288
                                                                                                                                                                                                                          Entropy (8bit):6.521808801015781
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:/uUk1Jzb9cKcIzWthWzaWf9BvVVWQ4mWmrcLUVT/gqnajKsrCOV:/bk1JzBcKcIzWthWzXNz1IlGsrCOV
                                                                                                                                                                                                                          MD5:0C933A4B3C2FCF1F805EDD849428C732
                                                                                                                                                                                                                          SHA1:B8B19318DBB1D2B7D262527ABD1468D099DE3FB6
                                                                                                                                                                                                                          SHA-256:A5B733E3DCE21AB62BD4010F151B3578C6F1246DA4A96D51AC60817865648DD3
                                                                                                                                                                                                                          SHA-512:B25ED54345A5B14E06AA9DADD07B465C14C23225023D7225E04FBD8A439E184A7D43AB40DF80E3F8A3C0F2D5C7A79B402DDC6B9093D0D798E612F4406284E39D
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d.....U..........." .........................................................0......Y.....`A........................................p................ ...................!..............p............................................................................rdata..4...........................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\api-ms-win-core-processthreads-l1-1-1.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):12240
                                                                                                                                                                                                                          Entropy (8bit):6.671157737548847
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:7oDfIeVWthWZWf9BvVVWQ4mWaHvP+CjAWqnajKsNZ:7oDfIeVWthWMNVP+CcWlGsNZ
                                                                                                                                                                                                                          MD5:7E8B61D27A9D04E28D4DAE0BFA0902ED
                                                                                                                                                                                                                          SHA1:861A7B31022915F26FB49C79AC357C65782C9F4B
                                                                                                                                                                                                                          SHA-256:1EF06C600C451E66E744B2CA356B7F4B7B88BA2F52EC7795858D21525848AC8C
                                                                                                                                                                                                                          SHA-512:1C5B35026937B45BEB76CB8D79334A306342C57A8E36CC15D633458582FC8F7D9AB70ACE7A92144288C6C017F33ECFC20477A04432619B40A21C9CDA8D249F6D
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d..............." .........................................................0......N.....`A........................................p................ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\api-ms-win-core-profile-l1-1-0.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):11728
                                                                                                                                                                                                                          Entropy (8bit):6.599056003106114
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:gR7WthWTVWf9BvVVWQ4mWg2a5P+CjAWqnajKsNQbWl:gVWthWkN/P+CcWlGsNMg
                                                                                                                                                                                                                          MD5:8D12FFD920314B71F2C32614CC124FEC
                                                                                                                                                                                                                          SHA1:251A98F2C75C2E25FFD0580F90657A3EA7895F30
                                                                                                                                                                                                                          SHA-256:E63550608DD58040304EA85367E9E0722038BA8E7DC7BF9D91C4D84F0EC65887
                                                                                                                                                                                                                          SHA-512:5084C739D7DE465A9A78BCDBB8A3BD063B84A68DCFD3C9EF1BFA224C1CC06580E2A2523FD4696CFC48E9FD068A2C44DBC794DD9BDB43DC74B4E854C82ECD3EA5
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d.....X4.........." .........................................................0............`A........................................p................ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\api-ms-win-core-rtlsupport-l1-1-0.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):12240
                                                                                                                                                                                                                          Entropy (8bit):6.602527553095181
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:zGeVfcWthW+Wf9BvVVWQ4mWMiSID7DiqnajKswz5g:zGeVfcWthWjN6SIGlGswza
                                                                                                                                                                                                                          MD5:9FA3FC24186D912B0694A572847D6D74
                                                                                                                                                                                                                          SHA1:93184E00CBDDACAB7F2AD78447D0EAC1B764114D
                                                                                                                                                                                                                          SHA-256:91508AB353B90B30FF2551020E9755D7AB0E860308F16C2F6417DFB2E9A75014
                                                                                                                                                                                                                          SHA-512:95AD31C9082F57EA57F5B4C605331FCAD62735A1862AFB01EF8A67FEA4E450154C1AE0C411CF3AC5B9CD35741F8100409CC1910F69C1B2D807D252389812F594
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d.....P..........." .........................................................0.......`....`A........................................p................ ...................!..............p............................................................................rdata..P...........................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\api-ms-win-core-string-l1-1-0.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):11728
                                                                                                                                                                                                                          Entropy (8bit):6.6806369134652055
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:qyMv0WthWPWf9BvVVWQ4mWIv/r+YVqnajKsSF:qyMv0WthWCNBfVlGsSF
                                                                                                                                                                                                                          MD5:C9CBAD5632D4D42A1BC25CCFA8833601
                                                                                                                                                                                                                          SHA1:09F37353A89F1BFE49F7508559DA2922B8EFEB05
                                                                                                                                                                                                                          SHA-256:F3A7A9C98EBE915B1B57C16E27FFFD4DDF31A82F0F21C06FE292878E48F5883E
                                                                                                                                                                                                                          SHA-512:2412E0AFFDC6DB069DE7BD9666B7BAA1CD76AA8D976C9649A4C2F1FFCE27F8269C9B02DA5FD486EC86B54231B1A5EBF6A1C72790815B7C253FEE1F211086892F
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d....E.=.........." .........................................................0............`A........................................p................ ...................!..............p............................................................................rdata..,...........................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\api-ms-win-core-synch-l1-1-0.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):13776
                                                                                                                                                                                                                          Entropy (8bit):6.573983778839785
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:miwidv3V0dfpkXc0vVauzIWthWLN3fVlGsStY:nHdv3VqpkXc0vVaKbiYlY
                                                                                                                                                                                                                          MD5:4CCDE2D1681217E282996E27F3D9ED2E
                                                                                                                                                                                                                          SHA1:8EDA134B0294ED35E4BBAC4911DA620301A3F34D
                                                                                                                                                                                                                          SHA-256:D6708D1254ED88A948871771D6D1296945E1AA3AEB7E33E16CC378F396C61045
                                                                                                                                                                                                                          SHA-512:93FE6AE9A947AC88CC5ED78996E555700340E110D12B2651F11956DB7CEE66322C269717D31FCCB31744F4C572A455B156B368F08B70EDA9EFFEC6DE01DBAB23
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d....k,..........." .........................................................0......3.....`A........................................p...X............ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\api-ms-win-core-synch-l1-2-0.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):12240
                                                                                                                                                                                                                          Entropy (8bit):6.7137872023984055
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:TtZ3KjWthWzWf9BvVVWQ4mWXU0P+CjAWqnajKsN2v:TtZ3KjWthWeNwP+CcWlGsNa
                                                                                                                                                                                                                          MD5:E86CFC5E1147C25972A5EEFED7BE989F
                                                                                                                                                                                                                          SHA1:0075091C0B1F2809393C5B8B5921586BDD389B29
                                                                                                                                                                                                                          SHA-256:72C639D1AFDA32A65143BCBE016FE5D8B46D17924F5F5190EB04EFE954C1199A
                                                                                                                                                                                                                          SHA-512:EA58A8D5AA587B7F5BDE74B4D394921902412617100ED161A7E0BEF6B3C91C5DAE657065EA7805A152DD76992997017E070F5415EF120812B0D61A401AA8C110
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d...jN/..........." .........................................................0............`A........................................p...x............ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\api-ms-win-core-sysinfo-l1-1-0.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):12768
                                                                                                                                                                                                                          Entropy (8bit):6.614330511483598
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:vgdKIMFYJWthW2Wf9BvVVWQ4SW2zZ7uUgxfzfqnaj0OGWh:0hJWthW7NBzIrloYh
                                                                                                                                                                                                                          MD5:206ADCB409A1C9A026F7AFDFC2933202
                                                                                                                                                                                                                          SHA1:BB67E1232A536A4D1AE63370BD1A9B5431335E77
                                                                                                                                                                                                                          SHA-256:76D8E4ED946DEEFEEFA0D0012C276F0B61F3D1C84AF00533F4931546CBB2F99E
                                                                                                                                                                                                                          SHA-512:727AA0C4CD1A0B7E2AFFDCED5DA3A0E898E9BAE3C731FF804406AD13864CEE2B27E5BAAC653BAB9A0D2D961489915D4FCAD18557D4383ECB0A066902276955A7
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d....~y..........." .........................................................0............`A........................................p...H............ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\api-ms-win-core-timezone-l1-1-0.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):12240
                                                                                                                                                                                                                          Entropy (8bit):6.704366348384627
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:Ha2WthWKOWf9BvVVWQ4mWNOrVT/gqnajKsrCkb:Ha2WthWKTNz1IlGsrCo
                                                                                                                                                                                                                          MD5:91A2AE3C4EB79CF748E15A58108409AD
                                                                                                                                                                                                                          SHA1:D402B9DF99723EA26A141BFC640D78EAF0B0111B
                                                                                                                                                                                                                          SHA-256:B0EDA99EABD32FEFECC478FD9FE7439A3F646A864FDAB4EC3C1F18574B5F8B34
                                                                                                                                                                                                                          SHA-512:8527AF610C1E2101B6F336A142B1A85AC9C19BB3AF4AD4A245CFB6FD602DC185DA0F7803358067099475102F3A8F10A834DC75B56D3E6DED2ED833C00AD217ED
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d.....%j.........." .........................................................0......|B....`A........................................p...P............ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\api-ms-win-core-util-l1-1-0.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):11728
                                                                                                                                                                                                                          Entropy (8bit):6.623077637622405
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:jWthWYWf9BvVVWQ4mWd8l1P+CjAWqnajKsNeCw:jWthW9NnP+CcWlGsNex
                                                                                                                                                                                                                          MD5:1E4C4C8E643DE249401E954488744997
                                                                                                                                                                                                                          SHA1:DB1C4C0FC907100F204B21474E8CD2DB0135BC61
                                                                                                                                                                                                                          SHA-256:F28A8FE2CD7E8E00B6D2EC273C16DB6E6EEA9B6B16F7F69887154B6228AF981E
                                                                                                                                                                                                                          SHA-512:EF8411FD321C0E363C2E5742312CC566E616D4B0A65EFF4FB6F1B22FDBEA3410E1D75B99E889939FF70AD4629C84CEDC88F6794896428C5F0355143443FDC3A3
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d.....R..........." .........................................................0............`A........................................p...<............ ...................!..............p............................................................................rdata..p...........................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\api-ms-win-crt-conio-l1-1-0.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):12752
                                                                                                                                                                                                                          Entropy (8bit):6.643812426159955
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:fSWthWvWf9BvVVWQ4mWFl5P+CjAWqnajKsNifl:aWthWiN+5P+CcWlGsNiN
                                                                                                                                                                                                                          MD5:FA770BCD70208A479BDE8086D02C22DA
                                                                                                                                                                                                                          SHA1:28EE5F3CE3732A55CA60AEE781212F117C6F3B26
                                                                                                                                                                                                                          SHA-256:E677497C1BAEFFFB33A17D22A99B76B7FA7AE7A0C84E12FDA27D9BE5C3D104CF
                                                                                                                                                                                                                          SHA-512:F8D81E350CEBDBA5AFB579A072BAD7986691E9F3D4C9FEBCA8756B807301782EE6EB5BA16B045CFA29B6E4F4696E0554C718D36D4E64431F46D1E4B1F42DC2B8
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d................" .........................................................0......l.....`A........................................P................ ...................!..............p............................................................................rdata..@...........................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\api-ms-win-crt-convert-l1-1-0.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):15824
                                                                                                                                                                                                                          Entropy (8bit):6.438848882089563
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:yjQ/w8u4cyNWthWYWf9BvVVWQ4mWhu1BVT/gqnajKsrC74m:8yNWthW9Np1IlGsrCEm
                                                                                                                                                                                                                          MD5:4EC4790281017E616AF632DA1DC624E1
                                                                                                                                                                                                                          SHA1:342B15C5D3E34AB4AC0B9904B95D0D5B074447B7
                                                                                                                                                                                                                          SHA-256:5CF5BBB861608131B5F560CBF34A3292C80886B7C75357ACC779E0BF98E16639
                                                                                                                                                                                                                          SHA-512:80C4E20D37EFF29C7577B2D0ED67539A9C2C228EDB48AB05D72648A6ED38F5FF537715C130342BEB0E3EF16EB11179B9B484303354A026BDA3A86D5414D24E69
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d....P............" .........................................................@............`A........................................P................0...................!..............p............................................................................rdata..>...........................@..@.rsrc........0......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\api-ms-win-crt-environment-l1-1-0.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):12240
                                                                                                                                                                                                                          Entropy (8bit):6.6061629057490245
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:vWOPWthWAWf9BvVVWQ4mWWbgftmP+CjAWqnajKsNURPblh:BWthWFN+f8P+CcWlGsNURzv
                                                                                                                                                                                                                          MD5:7A859E91FDCF78A584AC93AA85371BC9
                                                                                                                                                                                                                          SHA1:1FA9D9CAD7CC26808E697373C1F5F32AAF59D6B7
                                                                                                                                                                                                                          SHA-256:B7EE468F5B6C650DADA7DB3AD9E115A0E97135B3DF095C3220DFD22BA277B607
                                                                                                                                                                                                                          SHA-512:A368F21ECA765AFCA86E03D59CF953500770F4A5BFF8B86B2AC53F1B5174C627E061CE9A1F781DC56506774E0D0B09725E9698D4DC2D3A59E93DA7EF3D900887
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d...t............." .........................................................0......H.....`A........................................P..."............ ...................!..............p............................................................................rdata..r...........................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\api-ms-win-crt-filesystem-l1-1-0.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):13776
                                                                                                                                                                                                                          Entropy (8bit):6.65347762698107
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:WxSnWlC0i5ClWthWTWf9BvVVWQ4mW+hkKVT/gqnajKsrCw/:WxSnWm5ClWthW+NkK1IlGsrCY
                                                                                                                                                                                                                          MD5:972544ADE7E32BFDEB28B39BC734CDEE
                                                                                                                                                                                                                          SHA1:87816F4AFABBDEC0EC2CFEB417748398505C5AA9
                                                                                                                                                                                                                          SHA-256:7102F8D9D0F3F689129D7FE071B234077FBA4DD3687071D1E2AEAA137B123F86
                                                                                                                                                                                                                          SHA-512:5E1131B405E0C7A255B1C51073AFF99E2D5C0D28FD3E55CABC04D463758A575A954008EA1BA5B4E2B345B49AF448B93AD21DFC4A01573B3CB6E7256D9ECCEEF1
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d...1............" .........................................................0......':....`A........................................P................ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\api-ms-win-crt-heap-l1-1-0.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):12752
                                                                                                                                                                                                                          Entropy (8bit):6.58394079658593
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:YFY17aFBRQWthWIWf9BvVVWQ4mWHhOP+CjAWqnajKsNngJ:YQtWthWNNdP+CcWlGsNI
                                                                                                                                                                                                                          MD5:8906279245F7385B189A6B0B67DF2D7C
                                                                                                                                                                                                                          SHA1:FCF03D9043A2DAAFE8E28DEE0B130513677227E4
                                                                                                                                                                                                                          SHA-256:F5183B8D7462C01031992267FE85680AB9C5B279BEDC0B25AB219F7C2184766F
                                                                                                                                                                                                                          SHA-512:67CAC89AE58CC715976107F3BDF279B1E78945AFD07E6F657E076D78E92EE1A98E3E7B8FEAE295AF5CE35E00C804F3F53A890895BADB1EED32377D85C21672B9
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d................." .........................................................0.......l....`A........................................P................ ...................!..............p............................................................................rdata..f...........................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\api-ms-win-crt-locale-l1-1-0.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):12240
                                                                                                                                                                                                                          Entropy (8bit):6.696904963591775
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:m8qWthWLWf9BvVVWQ4WWLXlyBZr+YVqnajKsS1:mlWthWWN0uZfVlGsS1
                                                                                                                                                                                                                          MD5:DD8176E132EEDEA3322443046AC35CA2
                                                                                                                                                                                                                          SHA1:D13587C7CC52B2C6FBCAA548C8ED2C771A260769
                                                                                                                                                                                                                          SHA-256:2EB96422375F1A7B687115B132A4005D2E7D3D5DC091FB0EB22A6471E712848E
                                                                                                                                                                                                                          SHA-512:77CB8C44C8CC8DD29997FBA4424407579AC91176482DB3CF7BC37E1F9F6AA4C4F5BA14862D2F3A9C05D1FDD7CA5A043B5F566BD0E9A9E1ED837DA9C11803B253
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d...r..[.........." .........................................................0.......P....`A........................................P...e............ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\api-ms-win-crt-math-l1-1-0.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):20944
                                                                                                                                                                                                                          Entropy (8bit):6.216554714002396
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:rQM4Oe59Ckb1hgmLRWthW0N0JBJ1IlGsrC5W:sMq59Bb1jYNABHJc
                                                                                                                                                                                                                          MD5:A6A3D6D11D623E16866F38185853FACD
                                                                                                                                                                                                                          SHA1:FBEADD1E9016908ECCE5753DE1D435D6FCF3D0B5
                                                                                                                                                                                                                          SHA-256:A768339F0B03674735404248A039EC8591FCBA6FF61A3C6812414537BADD23B0
                                                                                                                                                                                                                          SHA-512:ABBF32CEB35E5EC6C1562F9F3B2652B96B7DBD97BFC08D918F987C0EC0503E8390DD697476B2A2389F0172CD8CF16029FD2EC5F32A9BA3688BF2EBEEFB081B2C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d..............." .........,...............................................P............`A........................................P....%...........@...............0...!..............p............................................................................rdata...&.......(..................@..@.rsrc........@.......,..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\api-ms-win-crt-multibyte-l1-1-0.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):19920
                                                                                                                                                                                                                          Entropy (8bit):6.194200929301547
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:8A/kPLPmIHJI6/CpG3t2G3t4odXLRWthW/N5GlGswz3:3/kjPmIHJI6manp3
                                                                                                                                                                                                                          MD5:B5C8AF5BADCDEFD8812AF4F63364FE2B
                                                                                                                                                                                                                          SHA1:750678935010A83E2D83769445F0D249E4568A8D
                                                                                                                                                                                                                          SHA-256:7101B3DFF525EA47B7A40DD96544C944AE400447DF7A6ACD07363B6D7968B889
                                                                                                                                                                                                                          SHA-512:A2A8D08D658F5ED368F9FB556BFB13B897F31E9540BFDFFF6567826614D6C5F0D64BD08FEC66C63E74D852AB6B083294E187507E83F2BC284DFB7CA5C86AE047
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d......:.........." .........(...............................................P......uM....`A........................................P.... ...........@...............,...!..............p............................................................................rdata..D".......$..................@..@.rsrc........@.......(..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\api-ms-win-crt-process-l1-1-0.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):12752
                                                                                                                                                                                                                          Entropy (8bit):6.604643094751227
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:uFdyqjd7NWthWxWf9BvVVWQ4mW+JZD7DiqnajKswzR1:YQsWthWkNfZGlGswzR1
                                                                                                                                                                                                                          MD5:074B81A625FB68159431BB556D28FAB5
                                                                                                                                                                                                                          SHA1:20F8EAD66D548CFA861BC366BB1250CED165BE24
                                                                                                                                                                                                                          SHA-256:3AF38920E767BD9EBC08F88EAF2D08C748A267C7EC60EAB41C49B3F282A4CF65
                                                                                                                                                                                                                          SHA-512:36388C3EFFA0D94CF626DECAA1DA427801CC5607A2106ABDADF92252C6F6FD2CE5BF0802F5D0A4245A1FFDB4481464C99D60510CF95E83EBAF17BD3D6ACBC3DC
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d....u..........." .........................................................0............`A........................................P...x............ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\api-ms-win-crt-runtime-l1-1-0.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):16336
                                                                                                                                                                                                                          Entropy (8bit):6.449023660091811
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:eUW9MPrpJhhf4AN5/KihWthWBWf9BvVVWQ4mWRXwsD7DiqnajKswzK:eUZr7HWthWUNkGlGswzK
                                                                                                                                                                                                                          MD5:F1A23C251FCBB7041496352EC9BCFFBE
                                                                                                                                                                                                                          SHA1:BE4A00642EC82465BC7B3D0CC07D4E8DF72094E8
                                                                                                                                                                                                                          SHA-256:D899C2F061952B3B97AB9CDBCA2450290B0F005909DDD243ED0F4C511D32C198
                                                                                                                                                                                                                          SHA-512:31F8C5CD3B6E153073E2E2EDF0CA8072D0F787784F1611A57219349C1D57D6798A3ADBD6942B0F16CEF781634DD8691A5EC0B506DF21B24CB70AEE5523A03FD9
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d....h.y.........." .........................................................@............`A........................................P...4............0...................!..............p............................................................................rdata..............................@..@.rsrc........0......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\api-ms-win-crt-stdio-l1-1-0.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):17872
                                                                                                                                                                                                                          Entropy (8bit):6.3934828478655685
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:hA2uWYFxEpahDWthWDWf9BvVVWQ4mWR3ir+YVqnajKsSO:hIFVhDWthWONlfVlGsSO
                                                                                                                                                                                                                          MD5:55B2EB7F17F82B2096E94BCA9D2DB901
                                                                                                                                                                                                                          SHA1:44D85F1B1134EE7A609165E9C142188C0F0B17E0
                                                                                                                                                                                                                          SHA-256:F9D3F380023A4C45E74170FE69B32BCA506EE1E1FBE670D965D5B50C616DA0CB
                                                                                                                                                                                                                          SHA-512:0CF0770F5965A83F546253DECFA967D8F85C340B5F6EA220D3CAA14245F3CDB37C53BF8D3DA6C35297B22A3FA88E7621202634F6B3649D7D9C166A221D3456A5
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d......w.........." ......... ...............................................@......>>....`A........................................P...a............0...............$...!..............p............................................................................rdata..............................@..@.rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\api-ms-win-crt-string-l1-1-0.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):18384
                                                                                                                                                                                                                          Entropy (8bit):6.279474608881223
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:jvEvevdv8vPozmVx0C5yguNvZ5VQgx3SbwA7yMVIkFGlPWthWXNjqujGlGswz7:2ozmT5yguNvZ5VQgx3SbwA71IkFFaJft
                                                                                                                                                                                                                          MD5:9B79965F06FD756A5EFDE11E8D373108
                                                                                                                                                                                                                          SHA1:3B9DE8BF6B912F19F7742AD34A875CBE2B5FFA50
                                                                                                                                                                                                                          SHA-256:1A916C0DB285DEB02C0B9DF4D08DAD5EA95700A6A812EA067BD637A91101A9F6
                                                                                                                                                                                                                          SHA-512:7D4155C00D65C3554E90575178A80D20DC7C80D543C4B5C4C3F508F0811482515638FE513E291B82F958B4D7A63C9876BE4E368557B07FF062961197ED4286FB
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d...$............" ........."...............................................@............`A........................................P................0...............&...!..............p............................................................................rdata../...........................@..@.rsrc........0......."..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\api-ms-win-crt-time-l1-1-0.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):14288
                                                                                                                                                                                                                          Entropy (8bit):6.547753630184197
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:ENDCWthWHWf9BvVVWQ4mWG5xqcVT/gqnajKsrC/V:TWthW6N/xqc1IlGsrC/V
                                                                                                                                                                                                                          MD5:1D48A3189A55B632798F0E859628B0FB
                                                                                                                                                                                                                          SHA1:61569A8E4F37ADC353986D83EFC90DC043CDC673
                                                                                                                                                                                                                          SHA-256:B56BC94E8539603DD2F0FEA2F25EFD17966315067442507DB4BFFAFCBC2955B0
                                                                                                                                                                                                                          SHA-512:47F329102B703BFBB1EBAEB5203D1C8404A0C912019193C93D150A95BB0C5BA8DC101AC56D3283285F9F91239FC64A66A5357AFE428A919B0BE7194BADA1F64F
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d...E............" .........................................................0......f.....`A........................................P................ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\api-ms-win-crt-utility-l1-1-0.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):12240
                                                                                                                                                                                                                          Entropy (8bit):6.686357863452704
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:ZjfHQdufWthWCWf9BvVVWQ4mWMlUteSP+CjAWqnajKsN0c:ZfZWthW/Nd4P+CcWlGsN0c
                                                                                                                                                                                                                          MD5:DBC27D384679916BA76316FB5E972EA6
                                                                                                                                                                                                                          SHA1:FB9F021F2220C852F6FF4EA94E8577368F0616A4
                                                                                                                                                                                                                          SHA-256:DD14133ADF5C534539298422F6C4B52739F80ACA8C5A85CA8C966DEA9964CEB1
                                                                                                                                                                                                                          SHA-512:CC0D8C56749CCB9D007B6D3F5C4A8F1D4E368BB81446EBCD7CC7B40399BBD56D0ACABA588CA172ECB7472A8CBDDBD4C366FFA38094A832F6D7E343B813BA565E
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d....@n#.........." .........................................................0............`A........................................P...^............ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\base_library.zip

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1440734
                                                                                                                                                                                                                          Entropy (8bit):5.590383253842785
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24576:mQR5pATG8/R5lUKdcubgAnyfb8h30iwhBdYf9PfeYHHc:mQR5pE/RbPu
                                                                                                                                                                                                                          MD5:D220B7E359810266FE6885A169448FA0
                                                                                                                                                                                                                          SHA1:556728B326318B992B0DEF059ECA239EB14BA198
                                                                                                                                                                                                                          SHA-256:CA40732F885379489D75A2DEC8EB68A7CCE024F7302DD86D63F075E2745A1E7D
                                                                                                                                                                                                                          SHA-512:8F802C2E717B0CB47C3EEEA990FFA0214F17D00C79CE65A0C0824A4F095BDE9A3D9D85EFB38F8F2535E703476CB6F379195565761A0B1D738D045D7BB2C0B542
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:PK..........!.h%..b...b......._collections_abc.pyc............................................d.Z.d.d.l.m.Z.m.Z...d.d.l.Z...e.e.e.........................Z...e.d...............Z.d...Z...e.e...............Z.[.g.d...Z.d.Z...e...e.d.............................Z...e...e...e...........................................Z...e...e.i.................................................................Z...e...e.i.................................................................Z...e...e.i.................................................................Z...e...e.g.............................Z...e...e...e.g...........................................Z...e...e...e.d...........................................Z...e...e...e.d.d.z.............................................Z...e...e...e...........................................Z...e...e.d.............................Z ..e...e.d.............................Z!..e...e...e"..........................................Z#..e.i.......................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\certifi\cacert.pem

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):291528
                                                                                                                                                                                                                          Entropy (8bit):6.047650375646611
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6144:QW1x/M8fRR1jplkXURrVADwYCuCigT/QRSRqNb7d8iu5NP:QWb/TRJLWURrI5RWavdF0J
                                                                                                                                                                                                                          MD5:181AC9A809B1A8F1BC39C1C5C777CF2A
                                                                                                                                                                                                                          SHA1:9341E715CEA2E6207329E7034365749FCA1F37DC
                                                                                                                                                                                                                          SHA-256:488BA960602BF07CC63F4EF7AEC108692FEC41820FC3328A8E3F3DE038149AEE
                                                                                                                                                                                                                          SHA-512:E19A92B94AEDCF1282B3EF561BD471EA19ED361334092C55D72425F9183EBD1D30A619E493841B6F75C629F26F28DC682960977941B486C59475F21CF86FFF85
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.# Issuer: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Subject: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Label: "GlobalSign Root CA".# Serial: 4835703278459707669005204.# MD5 Fingerprint: 3e:45:52:15:09:51:92:e1:b7:5d:37:9f:b1:87:29:8a.# SHA1 Fingerprint: b1:bc:96:8b:d4:f4:9d:62:2a:a8:9a:81:f2:15:01:52:a4:1d:82:9c.# SHA256 Fingerprint: eb:d4:10:40:e4:bb:3e:c7:42:c9:e3:81:d3:1e:f2:a4:1a:48:b6:68:5c:96:e7:ce:f3:c1:df:6c:d4:33:1c:99.-----BEGIN CERTIFICATE-----.MIIDdTCCAl2gAwIBAgILBAAAAAABFUtaw5QwDQYJKoZIhvcNAQEFBQAwVzELMAkG.A1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExEDAOBgNVBAsTB1Jv.b3QgQ0ExGzAZBgNVBAMTEkdsb2JhbFNpZ24gUm9vdCBDQTAeFw05ODA5MDExMjAw.MDBaFw0yODAxMjgxMjAwMDBaMFcxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9i.YWxTaWduIG52LXNhMRAwDgYDVQQLEwdSb290IENBMRswGQYDVQQDExJHbG9iYWxT.aWduIFJvb3QgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDaDuaZ.jc6j40+Kfvvxi4Mla+pIH/EqsLmVEQS98GPR4mdmzxzdzxtIK+6NiY6arymAZavp.xy0Sy6scTHAHoT0KMM0VjU/43dSMUBUc71DuxC73/OlS8pF94G3VNTCOXkNz

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\charset_normalizer\md.cp311-win_amd64.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):10752
                                                                                                                                                                                                                          Entropy (8bit):4.673454313041419
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:KG+p72HzA5iJGhU2Y0hQMsQJCUCLsZEA4elh3XQMtCFliHUWQcX6g8cim1qeSju1:A2HzzU2bRYoeLHkcqgvimoe
                                                                                                                                                                                                                          MD5:723EC2E1404AE1047C3EF860B9840C29
                                                                                                                                                                                                                          SHA1:8FC869B92863FB6D2758019DD01EDBEF2A9A100A
                                                                                                                                                                                                                          SHA-256:790A11AA270523C2EFA6021CE4F994C3C5A67E8EAAAF02074D5308420B68BD94
                                                                                                                                                                                                                          SHA-512:2E323AE5B816ADDE7AAA14398F1FDB3EFE15A19DF3735A604A7DB6CADC22B753046EAB242E0F1FBCD3310A8FBB59FF49865827D242BAF21F44FD994C3AC9A878
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......B..............................M....................................... ...?.......?.......?.a.....?.......Rich............................PE..d...siAe.........." ...%.....................................................p............`..........................................'..p...`(..d....P.......@...............`..,...`#.............................. "..@............ ...............................text............................... ..`.rdata....... ......................@..@.data...8....0......."..............@....pdata.......@.......$..............@..@.rsrc........P.......&..............@..@.reloc..,....`.......(..............@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\charset_normalizer\md__mypyc.cp311-win_amd64.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):119296
                                                                                                                                                                                                                          Entropy (8bit):5.872097486056729
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:1536:OzgMw0g+m/+rxC9Jtd960WsCyqPD1/bZMlDML48Be9zGTVmZRJIRbvB:OsTH+VC9Jtd9VdCr7fMp/8yGTVmzmZ
                                                                                                                                                                                                                          MD5:9EA8098D31ADB0F9D928759BDCA39819
                                                                                                                                                                                                                          SHA1:E309C85C1C8E6CE049EEA1F39BEE654B9F98D7C5
                                                                                                                                                                                                                          SHA-256:3D9893AA79EFD13D81FCD614E9EF5FB6AAD90569BEEDED5112DE5ED5AC3CF753
                                                                                                                                                                                                                          SHA-512:86AF770F61C94DFBF074BCC4B11932BBA2511CAA83C223780112BDA4FFB7986270DC2649D4D3EA78614DBCE6F7468C8983A34966FC3F2DE53055AC6B5059A707
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........C..r...r...r......r...s...r...s...r...w...r...v..r...q...r.#.s...r...s...r..8z...r..8r...r..8....r..8p...r.Rich..r.........................PE..d...siAe.........." ...%.*..........0........................................ ............`.........................................p...d..........................................Px...............................w..@............@...............................text...X).......*.................. ..`.rdata...X...@...Z..................@..@.data...8=.......0..................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\cryptography-43.0.0.dist-info\INSTALLER

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):4
                                                                                                                                                                                                                          Entropy (8bit):1.5
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:Mn:M
                                                                                                                                                                                                                          MD5:365C9BFEB7D89244F2CE01C1DE44CB85
                                                                                                                                                                                                                          SHA1:D7A03141D5D6B1E88B6B59EF08B6681DF212C599
                                                                                                                                                                                                                          SHA-256:CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
                                                                                                                                                                                                                          SHA-512:D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:pip.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\cryptography-43.0.0.dist-info\METADATA

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):5440
                                                                                                                                                                                                                          Entropy (8bit):5.074743714114344
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:DlPQIUQIhQIKQILbQIRIaMPktjaVxsxA2TaLDmplH7dwnqTIvrUmA0JQTQCQx5KN:ecPuP1srTaLDmplH7JTIvYX0JQTQ9x54
                                                                                                                                                                                                                          MD5:1682E8458A9F3565FD0941626CBE4302
                                                                                                                                                                                                                          SHA1:E5937D80B6BA976905491C9DBD8E16D0226795B5
                                                                                                                                                                                                                          SHA-256:24F9838874233DE69F9DE9AEBD95359E499498508D962B605D90186288D7D8C0
                                                                                                                                                                                                                          SHA-512:2DC669A07DD263C967D637AC2E76ED3788830D96B91E256E16125997C4E3A68D268DC220C056BBFBC3B5E7DEF7D063B776D9D1DA303A840FF203DAE668D7A366
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:Metadata-Version: 2.3.Name: cryptography.Version: 43.0.0.Classifier: Development Status :: 5 - Production/Stable.Classifier: Intended Audience :: Developers.Classifier: License :: OSI Approved :: Apache Software License.Classifier: License :: OSI Approved :: BSD License.Classifier: Natural Language :: English.Classifier: Operating System :: MacOS :: MacOS X.Classifier: Operating System :: POSIX.Classifier: Operating System :: POSIX :: BSD.Classifier: Operating System :: POSIX :: Linux.Classifier: Operating System :: Microsoft :: Windows.Classifier: Programming Language :: Python.Classifier: Programming Language :: Python :: 3.Classifier: Programming Language :: Python :: 3 :: Only.Classifier: Programming Language :: Python :: 3.7.Classifier: Programming Language :: Python :: 3.8.Classifier: Programming Language :: Python :: 3.9.Classifier: Programming Language :: Python :: 3.10.Classifier: Programming Language :: Python :: 3.11.Classifier: Programming Language :: Python :: 3.12.Classif

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\cryptography-43.0.0.dist-info\RECORD

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:CSV text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):15485
                                                                                                                                                                                                                          Entropy (8bit):5.564090812037898
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:aXMKlej5z5jF4ELZVhXau4WPE6FGotqw++NX6in55qw/n+B:aXMZj5hCEJaiPE6FGotqw++96in5+B
                                                                                                                                                                                                                          MD5:5AD5EA98ABF6A64D03C4DD29DB5B14EB
                                                                                                                                                                                                                          SHA1:1ED79F451F6EDC77DBC25543F38F2AB479367C8D
                                                                                                                                                                                                                          SHA-256:4510A5800D33CC9C9AA0F240FE5CD95962A916A55D8B608634AE4ABB2D8DDB7C
                                                                                                                                                                                                                          SHA-512:F26F9161E8935D162CB487A56A69509721CDE9EA66906086E7A0EB6CA37A48B382CE6E6D457784A9EB1A7BDA5614D8C9D0169CBA9E940D8F4194A1EF1175391D
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:cryptography-43.0.0.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..cryptography-43.0.0.dist-info/METADATA,sha256=JPmDiHQjPeafnemuvZU1nkmUmFCNlitgXZAYYojX2MA,5440..cryptography-43.0.0.dist-info/RECORD,,..cryptography-43.0.0.dist-info/WHEEL,sha256=8_4EnrLvbhzH224YH8WypoB7HFn-vpbwr_zHlr3XUBI,94..cryptography-43.0.0.dist-info/license_files/LICENSE,sha256=Pgx8CRqUi4JTO6mP18u0BDLW8amsv4X1ki0vmak65rs,197..cryptography-43.0.0.dist-info/license_files/LICENSE.APACHE,sha256=qsc7MUj20dcRHbyjIJn2jSbGRMaBOuHk8F9leaomY_4,11360..cryptography-43.0.0.dist-info/license_files/LICENSE.BSD,sha256=YCxMdILeZHndLpeTzaJ15eY9dz2s0eymiSMqtwCPtPs,1532..cryptography/__about__.py,sha256=AuJuBuUXFu8XM-ndNcp4DzJNCld3qQyfRJFH_AgNI-0,445..cryptography/__init__.py,sha256=mthuUrTd4FROCpUYrTIqhjz6s6T9djAZrV7nZ1oMm2o,364..cryptography/__pycache__/__about__.cpython-311.pyc,,..cryptography/__pycache__/__init__.cpython-311.pyc,,..cryptography/__pycache__/exceptions.cpython-311.pyc,,..cryptography/__p

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\cryptography-43.0.0.dist-info\WHEEL

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):94
                                                                                                                                                                                                                          Entropy (8bit):5.016084900984752
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:RtEeX5pGogP+tkKciH/KQb:RtvoTWKTQb
                                                                                                                                                                                                                          MD5:C869D30012A100ADEB75860F3810C8C9
                                                                                                                                                                                                                          SHA1:42FD5CFA75566E8A9525E087A2018E8666ED22CB
                                                                                                                                                                                                                          SHA-256:F3FE049EB2EF6E1CC7DB6E181FC5B2A6807B1C59FEBE96F0AFFCC796BDD75012
                                                                                                                                                                                                                          SHA-512:B29FEAF6587601BBE0EDAD3DF9A87BFC82BB2C13E91103699BABD7E039F05558C0AC1EF7D904BCFAF85D791B96BC26FA9E39988DD83A1CE8ECCA85029C5109F0
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:Wheel-Version: 1.0.Generator: maturin (1.7.0).Root-Is-Purelib: false.Tag: cp39-abi3-win_amd64.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\cryptography-43.0.0.dist-info\license_files\LICENSE

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):197
                                                                                                                                                                                                                          Entropy (8bit):4.61968998873571
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:hWDncJhByZmJgXPForADu1QjygQuaAJygT2d5GeWreLRuOFEXAYeBKmJozlMHuO:h9Co8FyQjkDYc5tWreLBF/pn2mH1
                                                                                                                                                                                                                          MD5:8C3617DB4FB6FAE01F1D253AB91511E4
                                                                                                                                                                                                                          SHA1:E442040C26CD76D1B946822CAF29011A51F75D6D
                                                                                                                                                                                                                          SHA-256:3E0C7C091A948B82533BA98FD7CBB40432D6F1A9ACBF85F5922D2F99A93AE6BB
                                                                                                                                                                                                                          SHA-512:77A1919E380730BCCE5B55D76FBFFBA2F95874254FAD955BD2FE1DE7FC0E4E25B5FDAAB0FEFFD6F230FA5DC895F593CF8BFEDF8FDC113EFBD8E22FADAB0B8998
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:This software is made available under the terms of *either* of the licenses.found in LICENSE.APACHE or LICENSE.BSD. Contributions to cryptography are made.under the terms of *both* these licenses..

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\cryptography-43.0.0.dist-info\license_files\LICENSE.APACHE

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):11360
                                                                                                                                                                                                                          Entropy (8bit):4.426756947907149
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:nUDG5KXSD9VYUKhu1JVF9hFGvV/QiGkS594drFjuHYx5dvTrLh3kTSEnQHbHR:UIvlKM1zJlFvmNz5VrlkTS0QHt
                                                                                                                                                                                                                          MD5:4E168CCE331E5C827D4C2B68A6200E1B
                                                                                                                                                                                                                          SHA1:DE33EAD2BEE64352544CE0AA9E410C0C44FDF7D9
                                                                                                                                                                                                                          SHA-256:AAC73B3148F6D1D7111DBCA32099F68D26C644C6813AE1E4F05F6579AA2663FE
                                                                                                                                                                                                                          SHA-512:F451048E81A49FBFA11B49DE16FF46C52A8E3042D1BCC3A50AAF7712B097BED9AE9AED9149C21476C2A1E12F1583D4810A6D36569E993FE1AD3879942E5B0D52
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:. Apache License. Version 2.0, January 2004. https://www.apache.org/licenses/.. TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION.. 1. Definitions... "License" shall mean the terms and conditions for use, reproduction,. and distribution as defined by Sections 1 through 9 of this document... "Licensor" shall mean the copyright owner or entity authorized by. the copyright owner that is granting the License... "Legal Entity" shall mean the union of the acting entity and all. other entities that control, are controlled by, or are under common. control with that entity. For the purposes of this definition,. "control" means (i) the power, direct or indirect, to cause the. direction or management of such entity, whether by contract or. otherwise, or (ii) ownership of fifty percent (50%) or more of the. outstanding shares, or (iii) beneficial ow

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\cryptography-43.0.0.dist-info\license_files\LICENSE.BSD

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1532
                                                                                                                                                                                                                          Entropy (8bit):5.058591167088024
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:MjUnoorbOFFTJJyRrYFTjzMbmqEvBTP4m96432s4EOkUTKQROJ32s3yxsITf+3tY:MkOFJSrYJsaN5P406432svv32s3EsIqm
                                                                                                                                                                                                                          MD5:5AE30BA4123BC4F2FA49AA0B0DCE887B
                                                                                                                                                                                                                          SHA1:EA5B412C09F3B29BA1D81A61B878C5C16FFE69D8
                                                                                                                                                                                                                          SHA-256:602C4C7482DE6479DD2E9793CDA275E5E63D773DACD1ECA689232AB7008FB4FB
                                                                                                                                                                                                                          SHA-512:DDBB20C80ADBC8F4118C10D3E116A5CD6536F72077C5916D87258E155BE561B89EB45C6341A1E856EC308B49A4CB4DBA1408EABD6A781FBE18D6C71C32B72C41
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:Copyright (c) Individual contributors..All rights reserved...Redistribution and use in source and binary forms, with or without.modification, are permitted provided that the following conditions are met:.. 1. Redistributions of source code must retain the above copyright notice,. this list of conditions and the following disclaimer... 2. Redistributions in binary form must reproduce the above copyright. notice, this list of conditions and the following disclaimer in the. documentation and/or other materials provided with the distribution... 3. Neither the name of PyCA Cryptography nor the names of its contributors. may be used to endorse or promote products derived from this software. without specific prior written permission...THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND.ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED.WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOS

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\cryptography\hazmat\bindings\_rust.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):7926272
                                                                                                                                                                                                                          Entropy (8bit):6.5147148491950295
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:98304:YWAalLQ17mZ4P3+A2AzbF5pXDog7d81ERQK:UJbF5lDog7d4xK
                                                                                                                                                                                                                          MD5:B98D491EAD30F30E61BC3E865AB72F18
                                                                                                                                                                                                                          SHA1:DB165369B7F2AE513B51C4F3DEF9EA2668268221
                                                                                                                                                                                                                          SHA-256:35D5AEB890B99E6BAE3E6B863313FBC8A1A554ACBCD416FE901B1E1AE2993C98
                                                                                                                                                                                                                          SHA-512:044C9C39BDDB13020ED865D3AA30926460AE6DED5FDEA59ECA2B1CF6A4DED55728D883F19EE0749F95A4D93F66E04FCC62BC3BE67119C4CCABD17B003CF5F3C4
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......C_M..>#..>#..>#..F...>#.."..>#.. ..>#..'..>#..&..>#.LF"..>#.h."..>#..>"..<#...'.y=#..>#.>#...#..>#...!..>#.Rich.>#.........PE..d...-.f.........." ...(..Z..|........X......................................Py...........`.........................................0.r.......r..............`t..............`x.0.....j.T.....................j.(...`.j.@.............Z..............................text...;.Z.......Z................. ..`.rdata...p....Z..r....Z.............@..@.data....+...0s.......s.............@....pdata.......`t.......t.............@..@.reloc..0....`x.......x.............@..B........................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\libcrypto-3.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):5162776
                                                                                                                                                                                                                          Entropy (8bit):5.958207976652471
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:98304:S3+FRtLtlVriXpshX179Cahd4tC9P1+1CPwDvt3uFlDCi:ASRtLtvd99Cahd4tC9w1CPwDvt3uFlDz
                                                                                                                                                                                                                          MD5:51E8A5281C2092E45D8C97FBDBF39560
                                                                                                                                                                                                                          SHA1:C499C810ED83AAADCE3B267807E593EC6B121211
                                                                                                                                                                                                                          SHA-256:2A234B5AA20C3FAECF725BBB54FB33F3D94543F78FA7045408E905593E49960A
                                                                                                                                                                                                                          SHA-512:98B91719B0975CB38D3B3C7B6F820D184EF1B64D38AD8515BE0B8B07730E2272376B9E51631FE9EFD9B8A1709FEA214CF3F77B34EEB9FD282EB09E395120E7CB
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......./',.kFB.kFB.kFB.b>..yFB..:C.iFB..:G.gFB..:F.cFB..:A.oFB.kFC..FB. >C.`FB.;A.KFB.;F..EB.;B.jFB.;..jFB.;@.jFB.RichkFB.........................PE..d...x..e.........." ...#..6..*......v.........................................O.......O...`.........................................0.G.0.....M.@....0N.|.....K.\.....N../...@N.....PsC.8............................qC.@.............M..............................text...4.6.......6................. ..`.rdata..`.....6.......6.............@..@.data....n....J..<....J.............@....pdata........K.......J.............@..@.idata...%....M..&....M.............@..@.00cfg..u.... N.......M.............@..@.rsrc...|....0N.......M.............@..@.reloc..k....@N.......M.............@..B................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\libffi-8.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):39696
                                                                                                                                                                                                                          Entropy (8bit):6.641880464695502
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
                                                                                                                                                                                                                          MD5:0F8E4992CA92BAAF54CC0B43AACCCE21
                                                                                                                                                                                                                          SHA1:C7300975DF267B1D6ADCBAC0AC93FD7B1AB49BD2
                                                                                                                                                                                                                          SHA-256:EFF52743773EB550FCC6CE3EFC37C85724502233B6B002A35496D828BD7B280A
                                                                                                                                                                                                                          SHA-512:6E1B223462DC124279BFCA74FD2C66FE18B368FFBCA540C84E82E0F5BCBEA0E10CC243975574FA95ACE437B9D8B03A446ED5EE0C9B1B094147CEFAF704DFE978
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........iV...8...8...8..p....8.t9...8.p9...8...9...8.t=...8.t<...8.t;...8.1t<...8.1t;...8.1t8...8.1t:...8.Rich..8.........................PE..d...Sh.c.........." ...".H...(.......L...............................................n....`......................................... l.......p..P...............P....l.../......,...@d...............................c..@............`.. ............................text....G.......H.................. ..`.rdata..h....`.......L..............@..@.data................b..............@....pdata..P............d..............@..@.reloc..,............j..............@..B................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\libssl-3.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):790296
                                                                                                                                                                                                                          Entropy (8bit):5.607732992846443
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6144:7aO1lo7USZGjweMMHO4+xuVg7gCl2VdhMd1DdwMVn4TERUr3zgKpJJ/wknofFe9A:FkeMKOr97gCAE35gEGzLpwknofFe9XbE
                                                                                                                                                                                                                          MD5:BFC834BB2310DDF01BE9AD9CFF7C2A41
                                                                                                                                                                                                                          SHA1:FB1D601B4FCB29FF1B13B0D2ED7119BD0472205C
                                                                                                                                                                                                                          SHA-256:41AD1A04CA27A7959579E87FBBDA87C93099616A64A0E66260C983381C5570D1
                                                                                                                                                                                                                          SHA-512:6AF473C7C0997F2847EBE7CEE8EF67CD682DEE41720D4F268964330B449BA71398FDA8954524F9A97CC4CDF9893B8BDC7A1CF40E9E45A73F4F35A37F31C6A9C3
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........T..T..T..].3.Z....V......V....X....\....P....W..T..I....e....U.._.U....U..RichT..........PE..d......e.........." ...#.6..........K........................................0.......w....`..........................................w...Q..............s.... ..pM......./......`... ...8...............................@............................................text....4.......6.................. ..`.rdata...y...P...z...:..............@..@.data....N.......H..................@....pdata..XV... ...X..................@..@.idata..bc.......d...T..............@..@.00cfg..u...........................@..@.rsrc...s...........................@..@.reloc..?...........................@..B................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\psutil\_psutil_windows.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):67072
                                                                                                                                                                                                                          Entropy (8bit):5.909510426434191
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:1536:aJsHmR02IvVxv7WCyKm7c5Th4MBHTOvyyaZE:apIvryCyKx5Th4M5OvyyO
                                                                                                                                                                                                                          MD5:3E579844160DE8322D574501A0F91516
                                                                                                                                                                                                                          SHA1:C8DE193854F7FC94F103BD4AC726246981264508
                                                                                                                                                                                                                          SHA-256:95F01CE7E37F6B4B281DBC76E9B88F28A03CB02D41383CC986803275A1CD6333
                                                                                                                                                                                                                          SHA-512:EE2A026E8E70351D395329C78A07ACB1B9440261D2557F639E817A8149BA625173EF196AED3D1C986577D78DC1A7EC9FED759C19346C51511474FE6D235B1817
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......nT..*5..*5..*5..#M2. 5..x@..(5..x@..&5..x@.."5..x@...5...k..(5..aM..;5..*5...5...@..:5...@..+5...@^.+5...@..+5..Rich*5..................PE..d.....qf.........." .........h......\........................................@............`.........................................0...`.......@.... .......................0..(.......................................8............................................text...h........................... ..`.rdata..\I.......J..................@..@.data...x...........................@....pdata..............................@..@.rsrc........ ......................@..@.reloc..(....0......................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\pyexpat.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):199448
                                                                                                                                                                                                                          Entropy (8bit):6.37860626187966
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6144:JmRBHO1UpyGKEjQxmMLIQjmuMgk6k6k6k6k6k6jHlDX:JmRBHJS7Mgk6k6k6k6k6k6jFDX
                                                                                                                                                                                                                          MD5:6527063F18E8D49D04E2CC216C2F0B27
                                                                                                                                                                                                                          SHA1:917C349C62689F9B782A314CE4B2311B6B826606
                                                                                                                                                                                                                          SHA-256:5604F629523125904909547A97F3CDB5DBFE33B39878BAD77534DE0C3C034387
                                                                                                                                                                                                                          SHA-512:67C87D11683A0F4E1BC4083FF05EDEE423155F829051C3FA66CC4F2CFB98CF7374B3A06EB37095E19F5F2A6C8DA83F0C0E3F7EB964694992B525F81B1B00F423
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........................g.................................h.......................h.......h.......h.......h.......Rich....................PE..d......e.........." ...#..................................................... ......X.....`.............................................P................................/..........`3..T........................... 2..@............ ...............................text...3........................... ..`.rdata....... ......................@..@.data...@!..........................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\python3.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):67352
                                                                                                                                                                                                                          Entropy (8bit):6.1462717896521335
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:lGw/EsYpkVgBaz57kcDA7QKFmpz7cnzH/ks/KF61xubwmB1Cf//yhC74JFmpktJa:r/5k8cnzeJd9IVL0v7SyJwx/
                                                                                                                                                                                                                          MD5:D8BA00C1D9FCC7C0ABBFFB5C214DA647
                                                                                                                                                                                                                          SHA1:5FA9D5700B42A83BFCC125D1C45E0111B9D62035
                                                                                                                                                                                                                          SHA-256:E45452EFA356DB874F2E5FF08C9CC0FE22528609E5D341F8FB67BA48885AB77D
                                                                                                                                                                                                                          SHA-512:DF1B714494856F618A742791EEFBF470B2EEE07B51D983256E4386EA7D48DA5C7B1E896F222EA55A748C9413203886CDE3A65EF9E7EA069014FA626F81D79CD3
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........C..."e.."e.."e.0_m.."e.0_e.."e.0_..."e.0_g.."e.Rich."e.................PE..d......e.........." ...#.................................................................`.........................................`...P................................/..............T............................................................................rdata..............................@..@.rsrc...............................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\python311.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):5763864
                                                                                                                                                                                                                          Entropy (8bit):6.089317968812699
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:98304:CdT9zf0+IXY3qd4biqm46oWHrMGYPtA81:CdT9zflIXgq/epGWAs
                                                                                                                                                                                                                          MD5:65E381A0B1BC05F71C139B0C7A5B8EB2
                                                                                                                                                                                                                          SHA1:7C4A3ADF21EBCEE5405288FC81FC4BE75019D472
                                                                                                                                                                                                                          SHA-256:53A969094231B9032ABE4148939CE08A3A4E4B30B0459FC7D90C89F65E8DCD4A
                                                                                                                                                                                                                          SHA-512:4DB465EF927DFB019AB6FAEC3A3538B0C3A8693EA3C2148FD16163BF31C03C899DFDF350C31457EDF64E671E3CC3E46851F32F0F84B267535BEBC4768EF53D39
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......... ..qN.qN.qN.$.O.qN.$...qN.$.K.qN.$.J.qN.$.M.qN....qN...O.qN.qO..pN.B.C.]qN.B.N.qN.B...qN.B.L.qN.Rich.qN.........PE..d......e.........." ...#.R%..>7......=........................................\.....T.X...`...........................................@......[A......p[.......V../....W../....[.lC....).T...........................p.).@............p%..............................text...ZQ%......R%................. ..`.rdata.......p%......V%.............@..@.data....#....A..T...fA.............@....pdata.../....V..0....Q.............@..@PyRuntim......X.......S.............@....rsrc........p[......vV.............@..@.reloc..lC....[..D....V.............@..B........................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\pywin32_system32\pythoncom311.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):669696
                                                                                                                                                                                                                          Entropy (8bit):6.035392172368621
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:mjN+cC8C0nALOrc5qcse64RV7n04pd+1xeo:AN+cnCqrcEbefFno
                                                                                                                                                                                                                          MD5:F98264F2DACFC8E299391ED1180AB493
                                                                                                                                                                                                                          SHA1:849551B6D9142BF983E816FEF4C05E639D2C1018
                                                                                                                                                                                                                          SHA-256:0FE49EC1143A0EFE168809C9D48FE3E857E2AC39B19DB3FD8718C56A4056696B
                                                                                                                                                                                                                          SHA-512:6BB3DBD9F4D3E6B7BD294F3CB8B2EF4C29B9EFF85C0CFD5E2D2465BE909014A7B2ECD3DC06265B1B58196892BB04D3E6B0AA4B2CCBF3A716E0FF950EB28DB11C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........`...3...3...3..\3...3...2...3...2...3...2...3...2...3...2...3U..2...3...2...3...3..3U..2..3U..2...3U..2...3Rich...3................PE..d...f..d.........." ......................................................................`..........................................U...c..............l....@...z............... ......T...........................0...8............................................text............................... ..`.rdata...#.......$..................@..@.data....I..........................@....pdata...z...@...|..................@..@.rsrc...l...........................@..@.reloc... ......."..................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\pywin32_system32\pywintypes311.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):134656
                                                                                                                                                                                                                          Entropy (8bit):5.995319660651805
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3072:luJ2G0a2fYrFceQaVK756Y/r06trRjEKQze7KN9eJKVKG6j1J:luJ2faiYrFceQaVfY/rx1eze7KbewVrk
                                                                                                                                                                                                                          MD5:90B786DC6795D8AD0870E290349B5B52
                                                                                                                                                                                                                          SHA1:592C54E67CF5D2D884339E7A8D7A21E003E6482F
                                                                                                                                                                                                                          SHA-256:89F2A5C6BE1E70B3D895318FDD618506B8C0E9A63B6A1A4055DFF4ABDC89F18A
                                                                                                                                                                                                                          SHA-512:C6E1DBF25D260C723A26C88EC027D40D47F5E28FC9EB2DBC72A88813A1D05C7F75616B31836B68B87DF45C65EEF6F3EAED2A9F9767F9E2F12C45F672C2116E72
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......#.$g..wg..wg..wn.[wk..w5..vc..w..5wf..w5..vs..w5..vo..w5..vd..ws..vf..w...ve..ws..vl..wg..w...w...vj..w...vf..w...vf..wRichg..w........PE..d......d.........." ................L........................................P............`......................................... u..`B......,....0..l.......L............@..0...`Q..T............................Q..8............................................text............................... ..`.rdata..R...........................@..@.data....-.......(..................@....pdata..L...........................@..@.rsrc...l....0......................@..@.reloc..0....@......................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\select.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):30488
                                                                                                                                                                                                                          Entropy (8bit):6.582368880935187
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:neUeJhHq2GD9IVQGA5YiSyv3g+AMxkEdC:neUeJhK2GD9IVQGS7SyfgMxRC
                                                                                                                                                                                                                          MD5:8472D39B9EE6051C961021D664C7447E
                                                                                                                                                                                                                          SHA1:B284E3566889359576D43E2E0E99D4ACF068E4FB
                                                                                                                                                                                                                          SHA-256:8A9A103BC417DEDE9F6946D9033487C410937E1761D93C358C1600B82F0A711F
                                                                                                                                                                                                                          SHA-512:309F1EC491D9C39F4B319E7CE1ABDEDF11924301E4582D122E261E948705FB71A453FEC34F63DF9F9ABE7F8CC2063A56CD2C2935418AB54BE5596AADC2E90AD3
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........t.q|'.q|'.q|'...'.q|'q.}&.q|'q.y&.q|'q.x&.q|'q..&.q|'..}&.q|'.q}'.q|'..}&.q|'..q&.q|'..|&.q|'...'.q|'..~&.q|'Rich.q|'........PE..d......e.........." ...#.....2......................................................;.....`..........................................@..L...,A..x....p.......`.......H.../......L....3..T............................2..@............0...............................text............................... ..`.rdata.......0......................@..@.data........P.......6..............@....pdata.......`.......8..............@..@.rsrc........p.......<..............@..@.reloc..L............F..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\setuptools-65.5.0.dist-info\INSTALLER

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):4
                                                                                                                                                                                                                          Entropy (8bit):1.5
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:Mn:M
                                                                                                                                                                                                                          MD5:365C9BFEB7D89244F2CE01C1DE44CB85
                                                                                                                                                                                                                          SHA1:D7A03141D5D6B1E88B6B59EF08B6681DF212C599
                                                                                                                                                                                                                          SHA-256:CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
                                                                                                                                                                                                                          SHA-512:D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:pip.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\setuptools-65.5.0.dist-info\LICENSE

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1050
                                                                                                                                                                                                                          Entropy (8bit):5.072538194763298
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:1rmJHcwH0MP3gt8Hw1hj9QHOsUv4eOk4/+/m3oqMSFJ:1aJ8YHvEH5QHOs5exm3oEFJ
                                                                                                                                                                                                                          MD5:7A7126E068206290F3FE9F8D6C713EA6
                                                                                                                                                                                                                          SHA1:8E6689D37F82D5617B7F7F7232C94024D41066D1
                                                                                                                                                                                                                          SHA-256:DB3F0246B1F9278F15845B99FEC478B8B506EB76487993722F8C6E254285FAF8
                                                                                                                                                                                                                          SHA-512:C9F0870BC5D5EFF8769D9919E6D8DDE1B773543634F7D03503A9E8F191BD4ACC00A97E0399E173785D1B65318BAC79F41D3974AE6855E5C432AC5DACF8D13E8A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:Copyright Jason R. Coombs..Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to.deal in the Software without restriction, including without limitation the.rights to use, copy, modify, merge, publish, distribute, sublicense, and/or.sell copies of the Software, and to permit persons to whom the Software is.furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in.all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING.FROM, OUT OF OR IN CONNECTION WITH THE SOFTW

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\setuptools-65.5.0.dist-info\METADATA

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):6301
                                                                                                                                                                                                                          Entropy (8bit):5.107162422517841
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:W4rkAIG0wRg8wbNDdq6T9927uoU/GBpHFwTZ:Sq0wRg8wbNDdBh927uoU/GBRFi
                                                                                                                                                                                                                          MD5:9E59BD13BB75B38EB7962BF64AC30D6F
                                                                                                                                                                                                                          SHA1:70F6A68B42695D1BFA55ACB63D8D3351352B2AAC
                                                                                                                                                                                                                          SHA-256:80C7A3B78EA0DFF1F57855EE795E7D33842A0827AA1EF4EE17EC97172A80C892
                                                                                                                                                                                                                          SHA-512:67AC61739692ECC249EBDC8F5E1089F68874DCD65365DB1C389FDD0CECE381591A30B99A2774B8CAAA00E104F3E35FF3745AFF6F5F0781289368398008537AE7
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:Metadata-Version: 2.1.Name: setuptools.Version: 65.5.0.Summary: Easily download, build, install, upgrade, and uninstall Python packages.Home-page: https://github.com/pypa/setuptools.Author: Python Packaging Authority.Author-email: distutils-sig@python.org.Project-URL: Documentation, https://setuptools.pypa.io/.Project-URL: Changelog, https://setuptools.pypa.io/en/stable/history.html.Keywords: CPAN PyPI distutils eggs package management.Classifier: Development Status :: 5 - Production/Stable.Classifier: Intended Audience :: Developers.Classifier: License :: OSI Approved :: MIT License.Classifier: Programming Language :: Python :: 3.Classifier: Programming Language :: Python :: 3 :: Only.Classifier: Topic :: Software Development :: Libraries :: Python Modules.Classifier: Topic :: System :: Archiving :: Packaging.Classifier: Topic :: System :: Systems Administration.Classifier: Topic :: Utilities.Requires-Python: >=3.7.License-File: LICENSE.Provides-Extra: certs.Provides-Extra: docs.Requi

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\setuptools-65.5.0.dist-info\RECORD

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:CSV text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):37694
                                                                                                                                                                                                                          Entropy (8bit):5.555787611309118
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:vSzcBlShgRUhbul9nXJkpIVh498WjXYH0+5+E/8mrnaDoaQP7IOQRJqxBPgof2yd:vc853yQXYAY8AKCT9r2/GsIVxE9Im
                                                                                                                                                                                                                          MD5:087F72A04BB085627494651E36C4C513
                                                                                                                                                                                                                          SHA1:1E39070E246F91D8926268A033C6F584E629E2DE
                                                                                                                                                                                                                          SHA-256:BFB77A968E06417BD37023BF1A2D7F1AAE9D8E74231665D6699D5BB82BDBD7B0
                                                                                                                                                                                                                          SHA-512:39CE042A20324C6B63A192D70E56B36318C45D04B810A6BD333D1D40B6DAAD947AFB9156C003BC86C700A59F0F25753416D754DA06C808814920F92582CB6058
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:_distutils_hack/__init__.py,sha256=TSekhUW1fdE3rjU3b88ybSBkJxCEpIeWBob4cEuU3ko,6128.._distutils_hack/__pycache__/__init__.cpython-311.pyc,,.._distutils_hack/__pycache__/override.cpython-311.pyc,,.._distutils_hack/override.py,sha256=Eu_s-NF6VIZ4Cqd0tbbA5wtWky2IZPNd8et6GLt1mzo,44..distutils-precedence.pth,sha256=JjjOniUA5XKl4N5_rtZmHrVp0baW_LoHsN0iPaX10iQ,151..pkg_resources/__init__.py,sha256=fT5Y3P1tcSX8sJomClUU10WHeFmvqyNZM4UZHzdpAvg,108568..pkg_resources/__pycache__/__init__.cpython-311.pyc,,..pkg_resources/_vendor/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0..pkg_resources/_vendor/__pycache__/__init__.cpython-311.pyc,,..pkg_resources/_vendor/__pycache__/appdirs.cpython-311.pyc,,..pkg_resources/_vendor/__pycache__/zipp.cpython-311.pyc,,..pkg_resources/_vendor/appdirs.py,sha256=MievUEuv3l_mQISH5SF0shDk_BNhHHzYiAPrT3ITN4I,24701..pkg_resources/_vendor/importlib_resources/__init__.py,sha256=evPm12kLgYqTm-pbzm60bOuumumT8IpBNWFp0uMyrzE,506..pkg_resources/_vendor/importli

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\setuptools-65.5.0.dist-info\WHEEL

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):92
                                                                                                                                                                                                                          Entropy (8bit):4.820827594031884
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:RtEeX7MWcSlViZHKRRP+tPCCfA5S:RtBMwlViojWBBf
                                                                                                                                                                                                                          MD5:4D57030133E279CEB6A8236264823DFD
                                                                                                                                                                                                                          SHA1:0FDC3988857C560E55D6C36DCC56EE21A51C196D
                                                                                                                                                                                                                          SHA-256:1B5E87E00DC87A84269CEAD8578B9E6462928E18A95F1F3373C9EEF451A5BCC0
                                                                                                                                                                                                                          SHA-512:CD98F2A416AC1B13BA82AF073D0819C0EA7C095079143CAB83037D48E9A5450D410DC5CF6B6CFF3F719544EDF1C5F0C7E32E87B746F1C04FE56FAFD614B39826
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:Wheel-Version: 1.0.Generator: bdist_wheel (0.37.1).Root-Is-Purelib: true.Tag: py3-none-any..

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\setuptools-65.5.0.dist-info\entry_points.txt

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):2740
                                                                                                                                                                                                                          Entropy (8bit):4.540737240939103
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:lELcZDy3g6ySDsm90rZh2Phv4hhpTqTog:yLAP8arZoP94hTTqcg
                                                                                                                                                                                                                          MD5:D3262B65DB35BFFAAC248075345A266C
                                                                                                                                                                                                                          SHA1:93AD6FE5A696252B9DEF334D182432CDA2237D1D
                                                                                                                                                                                                                          SHA-256:DEC880BB89189B5C9B1491C9EE8A2AA57E53016EF41A2B69F5D71D1C2FBB0453
                                                                                                                                                                                                                          SHA-512:1726750B22A645F5537C20ADDF23E3D3BAD851CD4BDBA0F9666F9F6B0DC848F9919D7AF8AD8847BD4F18D0F8585DDE51AFBAE6A4CAD75008C3210D17241E0291
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:[distutils.commands].alias = setuptools.command.alias:alias.bdist_egg = setuptools.command.bdist_egg:bdist_egg.bdist_rpm = setuptools.command.bdist_rpm:bdist_rpm.build = setuptools.command.build:build.build_clib = setuptools.command.build_clib:build_clib.build_ext = setuptools.command.build_ext:build_ext.build_py = setuptools.command.build_py:build_py.develop = setuptools.command.develop:develop.dist_info = setuptools.command.dist_info:dist_info.easy_install = setuptools.command.easy_install:easy_install.editable_wheel = setuptools.command.editable_wheel:editable_wheel.egg_info = setuptools.command.egg_info:egg_info.install = setuptools.command.install:install.install_egg_info = setuptools.command.install_egg_info:install_egg_info.install_lib = setuptools.command.install_lib:install_lib.install_scripts = setuptools.command.install_scripts:install_scripts.rotate = setuptools.command.rotate:rotate.saveopts = setuptools.command.saveopts:saveopts.sdist = setuptools.command.sdist:sdist.seto

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\setuptools-65.5.0.dist-info\top_level.txt

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):41
                                                                                                                                                                                                                          Entropy (8bit):3.9115956018096876
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:3Wd+Nt8AfQYv:3Wd+Nttv
                                                                                                                                                                                                                          MD5:789A691C859DEA4BB010D18728BAD148
                                                                                                                                                                                                                          SHA1:AEF2CBCCC6A9A8F43E4E150E7FCF1D7B03F0E249
                                                                                                                                                                                                                          SHA-256:77DC8BDFDBFF5BBAA62830D21FAB13E1B1348FF2ECD4CDCFD7AD4E1A076C9B88
                                                                                                                                                                                                                          SHA-512:BC2F7CAAD486EB056CB9F68E6C040D448788C3210FF028397CD9AF1277D0051746CAE58EB172F9E73EA731A65B2076C6091C10BCB54D911A7B09767AA6279EF6
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:_distutils_hack.pkg_resources.setuptools.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\sqlite3.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1504024
                                                                                                                                                                                                                          Entropy (8bit):6.578984314535122
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24576:M5WQyUuqjJVKMXijWRwtHHofIyEcL/2m75i5zxHWc9C08lYfore60b:Mb0yVKMyjWR6nofQm7U59HWKYYD
                                                                                                                                                                                                                          MD5:256224CC25D085663D4954BE6CC8C5B5
                                                                                                                                                                                                                          SHA1:9931CC156642E2259DFABF0154FDDF50D86E9334
                                                                                                                                                                                                                          SHA-256:5AC6EE18CDCA84C078B66055F5E9FFC6F8502E22EAF0FA54AEEC92B75A3C463E
                                                                                                                                                                                                                          SHA-512:A28ABF03199F0CE9F044329F7EBA2F1D8ECBC43674337AAFBF173F567158BA9046036DA91DC3E12C2BB1D7842953526EDBA14BC03F81ECE63DCEDCC9413213A7
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........W..W..W..^.P.[....U....Z...._.....S.....T..W........V.....V....<.V......V..RichW..........................PE..d......e.........." ...#..................................................................`.........................................Px...".............................../...........*..T............................(..@...............8............................text............................... ..`.rdata..............................@..@.data...PG.......>..................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\ucrtbase.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1035728
                                                                                                                                                                                                                          Entropy (8bit):6.630126944065657
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24576:EsKxVJ/pRRK0Y/9fCrl4NbpjONcncXEomxvSZX0yp49C:lKxDPHQCrlQBXxw
                                                                                                                                                                                                                          MD5:849959A003FA63C5A42AE87929FCD18B
                                                                                                                                                                                                                          SHA1:D1B80B3265E31A2B5D8D7DA6183146BBD5FB791B
                                                                                                                                                                                                                          SHA-256:6238CBFE9F57C142B75E153C399C478D492252FDA8CB40EE539C2DCB0F2EB232
                                                                                                                                                                                                                          SHA-512:64958DABDB94D21B59254C2F074DB5D51E914DDBC8437452115DFF369B0C134E50462C3FDBBC14B6FA809A6EE19AB2FB83D654061601CC175CDDCB7D74778E09
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........of...5...5...5..5...5...5&..5...5...5...4...5...4...5...4...5...4...5...4..5...5...5...4...5Rich...5........PE..d.....$%.........." .....:..........0Z..............................................7^....`A................................................................. ...........!.............p........................... f..............................................text...09.......:.................. ..`.rdata..^....P.......>..............@..@.data....&..........................@....pdata....... ......................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\unicodedata.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1141016
                                                                                                                                                                                                                          Entropy (8bit):5.435201566416684
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:C3kYbfjwR6nbVonRiPDjRrO5184EPYPx++ZiLKGZ5KXyVH4eD1Ji:CUYbM40IDJcjEwPgPOG6Xyd461Ji
                                                                                                                                                                                                                          MD5:57F8F40CF955561A5044DDFFA4F2E144
                                                                                                                                                                                                                          SHA1:19218025BCAE076529E49DDE8C74F12E1B779279
                                                                                                                                                                                                                          SHA-256:1A965C1904DA88989468852FDC749B520CCE46617B9190163C8DF19345B59560
                                                                                                                                                                                                                          SHA-512:DB2A7A32E0B5BF0684A8C4D57A1D7DF411D8EB1BC3828F44C95235DD3AF40E50A198427350161DFF2E79C07A82EF98E1536E0E013030A15BDF1116154F1D8338
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......p...4m..4m..4m..=...2m......6m......9m......<m......7m......7m......6m..4m..em......5m......5m....j.5m......5m..Rich4m..................PE..d......e.........." ...#.@..........P*...............................................~....`.............................................X............`.......P..0....:.../...p.......]..T............................[..@............P..x............................text....>.......@.................. ..`.rdata.......P.......D..............@..@.data...H....0......................@....pdata..0....P.......&..............@..@.rsrc........`......................@..@.reloc.......p.......8..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\win32\_win32sysloader.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):14848
                                                                                                                                                                                                                          Entropy (8bit):5.115373165177945
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:yuCm72PEO1jIUs0YqEcPbF55UgCWV4rofnbPutEvbqDLWn7ycLmrN/:LardA0Bzx14r6nbF0W+/
                                                                                                                                                                                                                          MD5:6B3D025362F13D2E112D7FEC4B58BF0C
                                                                                                                                                                                                                          SHA1:4A26921FCD1E9EE19C2D8BF67FB8ACF9C48AE359
                                                                                                                                                                                                                          SHA-256:48D2D1F61383DCAF65F5F4F08CAE96F4A915EB89C3EA23D0EF9AE7B0A8173399
                                                                                                                                                                                                                          SHA-512:3023901EDFF779DBD1FF37BA9FB950ECD6D9AC8117EA7A0585A004DA453B98AE5EAB8C2B15C85DCD6E0E9C24EF6734D4AE322B9E5C5E6C9553148B01A14BE808
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......d.f. ... ... ...).."...r..."...4..."...r...+...r...(...r...#.......#... ...........!.......!.......!...Rich ...........PE..d......d.........." ......................................................................`..........................................;..`...`;..d....p..t....`..................@...|2..T............................2..8............0..p............................text............................... ..`.rdata..$....0......................@..@.data........P......................@....pdata.......`.......0..............@..@.rsrc...t....p.......4..............@..@.reloc..@............8..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\win32\win32api.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):133632
                                                                                                                                                                                                                          Entropy (8bit):5.851354810898845
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3072:HPwB2zC1vwC3XetCf5RlRVFhLaNKPAyymhNYm9b9e:HIB2zkvwGXetCfDlRVlPAyLYm9
                                                                                                                                                                                                                          MD5:1D6762B494DC9E60CA95F7238AE1FB14
                                                                                                                                                                                                                          SHA1:AA0397D96A0ED41B2F03352049DAFE040D59AD5D
                                                                                                                                                                                                                          SHA-256:FAE5323E2119A8F678055F4244177B5806C7B6B171B1945168F685631B913664
                                                                                                                                                                                                                          SHA-512:0B561F651161A34C37FF8D115F154C52202F573D049681F8CDD7BBA2E966BB8203780C19BA824B4A693EF12EF1EEEF6AEEEF96EB369E4B6129F1DEB6B26AAA00
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........I^.f'..f'..f'......f'...&..f'...#..f'...$..f'.o.&..f'..."..f'...&..f'..f&..g'.o....f'.o.'..f'.o.%..f'.Rich.f'.................PE..d......d.........." .........................................................P............`..........................................................0..\....................@..$....v..T............................<..8............0..........@....................text...$........................... ..`.rdata......0......................@..@.data...x(......."..................@....pdata..............................@..@.rsrc...\....0......................@..@.reloc..$....@......................@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\win32\win32crypt.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):123904
                                                                                                                                                                                                                          Entropy (8bit):5.966536263597539
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:1536:qcoj2WDPYNSPEkIrFCkAShRD/bv0SShzljLraBqf9308qxJ83zEBoPTEdLQEF8/d:q7jbPA0SD9S3vrCqf93xM4TEdLZn1xa
                                                                                                                                                                                                                          MD5:5390ADE0ED5428024F3D854B5B9BFE9F
                                                                                                                                                                                                                          SHA1:DADA7B44887DCB7B77DCADB9690BAECF3EE2B937
                                                                                                                                                                                                                          SHA-256:9771F09BE29BD7A69ABE774E28472A392382883C18A3CC524F8141E84B1BE22C
                                                                                                                                                                                                                          SHA-512:92E82EFF79F45D4DE1CF27946A357F122C5337A85315D7C139458A1A6A51DFFBF3CBFCF832851FBDCD0EC1BD0F82E7089125FFBBE3275675433089BDDBFF865B
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........U...U...U...\.v.S.......Q.......E.......].......V.....Q...A...R...U........\.....T.....T...RichU...........PE..d......d.........." ................(........................................ ............`..........................................o..................d.......................H....G..T............................H..8............................................text...~........................... ..`.rdata..............................@..@.data....-.......(..................@....pdata..............................@..@.rsrc...d...........................@..@.reloc..H...........................@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\win32\win32trace.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):23552
                                                                                                                                                                                                                          Entropy (8bit):5.2797447560366155
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:JPeeH8ZmV+zknwMsADuVLw0T8DmDRl2jYI7AHCQnpC9QJX1B5:JL+zi/uVbSYI4d6CB
                                                                                                                                                                                                                          MD5:2705D0AC399B949261F4D9AF473DBA7C
                                                                                                                                                                                                                          SHA1:2B84CEDFCB90F8278E698AC2319C860F373060F2
                                                                                                                                                                                                                          SHA-256:961D93DBD18F33685C5384F4346D8AF2A452E51F7171E6CB053B9BB260EDA5A3
                                                                                                                                                                                                                          SHA-512:F546670352D5934F11EFBE53AE382EE96E9D88DB7A8709EE1CEC36474E61E3C3DD9EDC01A8557152A0F3F0CF808410E31AE37F178BB2F34EC00156808103C72D
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........>].OP..OP..OP..7...OP..:Q..OP..:U..OP..:T..OP..:S..OP..:Q..OP..$Q..OP..OQ..OP..:Y..OP..:P..OP..:R..OP.Rich.OP.................PE..d......d.........." .....,...,.......(....................................................`..........................................Q..T...dQ..........d....p.......................G..T...........................0H..8............@...............................text....*.......,.................. ..`.rdata.......@.......0..............@..@.data...(....`.......L..............@....pdata.......p.......R..............@..@.rsrc...d............V..............@..@.reloc...............Z..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI59682\win32com\shell\shell.pyd

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):528384
                                                                                                                                                                                                                          Entropy (8bit):6.160492941773028
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6144:x1uoSNIiaRGfvtQqmJeRAsgUW9yKj6pWa1P5ziI7RRWf:x1uoSNIH8HtQbems66pWab37R4f
                                                                                                                                                                                                                          MD5:8A0C2F96414475498D6E9BADA00DE986
                                                                                                                                                                                                                          SHA1:BB8E66F3DF9F25B12777E3F48BA7069940F0C920
                                                                                                                                                                                                                          SHA-256:3F45C59F75E61FA93B5C2B1F65995B621C3FD301FB500A17599BEFA54538D1D0
                                                                                                                                                                                                                          SHA-512:75D718F30209D81819CEA7B148D3A8DD7FCB9FC94E87A8DD5D7C795B334DEACD6A598F583475B7005D0E81929C9E70F19BABFE92BE1E1E39F62296078FDEEAEA
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A{.C.............bh.....Wo......Wo......Wo......Wo.......q.......o.......q.......q...............o..C....o.......o......Rich....................PE..d...#..d.........." .....$................................................................`.............................................L...............L.......xx...............!......T..............................8............@...............................text...n#.......$.................. ..`.rdata.......@.......(..............@..@.data...@....0...^..................@....pdata..xx.......z...p..............@..@.rsrc...L...........................@..@.reloc...!......."..................@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_51nkywsp.ezf.ps1

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                          File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):60
                                                                                                                                                                                                                          Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                          MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                          SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                          SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                          SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_g5kehf0i.tsk.psm1

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                          File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):60
                                                                                                                                                                                                                          Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                          MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                          SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                          SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                          SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_iygjownp.nba.psm1

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                          File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):60
                                                                                                                                                                                                                          Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                          MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                          SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                          SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                          SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lyjb5edz.x03.ps1

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                          File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):60
                                                                                                                                                                                                                          Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                          MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                          SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                          SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                          SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_t05pjie1.lse.ps1

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                          File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):60
                                                                                                                                                                                                                          Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                          MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                          SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                          SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                          SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wl4112lm.ve0.psm1

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                          File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):60
                                                                                                                                                                                                                          Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                          MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                          SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                          SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                          SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\autofill_db

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):196608
                                                                                                                                                                                                                          Entropy (8bit):1.1239949490932863
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
                                                                                                                                                                                                                          MD5:271D5F995996735B01672CF227C81C17
                                                                                                                                                                                                                          SHA1:7AEAACD66A59314D1CBF4016038D3A0A956BAF33
                                                                                                                                                                                                                          SHA-256:9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
                                                                                                                                                                                                                          SHA-512:62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\cards_db

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):196608
                                                                                                                                                                                                                          Entropy (8bit):1.1239949490932863
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
                                                                                                                                                                                                                          MD5:271D5F995996735B01672CF227C81C17
                                                                                                                                                                                                                          SHA1:7AEAACD66A59314D1CBF4016038D3A0A956BAF33
                                                                                                                                                                                                                          SHA-256:9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
                                                                                                                                                                                                                          SHA-512:62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\cookie_db

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):20480
                                                                                                                                                                                                                          Entropy (8bit):0.6732424250451717
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
                                                                                                                                                                                                                          MD5:CFFF4E2B77FC5A18AB6323AF9BF95339
                                                                                                                                                                                                                          SHA1:3AA2C2115A8EB4516049600E8832E9BFFE0C2412
                                                                                                                                                                                                                          SHA-256:EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
                                                                                                                                                                                                                          SHA-512:0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\downloads_db

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):155648
                                                                                                                                                                                                                          Entropy (8bit):0.5407252242845243
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:OgWyejzH+bDoYysX0IxQzZkHtpVJNlYDLjGQLBE3CeE0kE:OJhH+bDo3iN0Z2TVJkXBBE3yb
                                                                                                                                                                                                                          MD5:7B955D976803304F2C0505431A0CF1CF
                                                                                                                                                                                                                          SHA1:E29070081B18DA0EF9D98D4389091962E3D37216
                                                                                                                                                                                                                          SHA-256:987FB9BFC2A84C4C605DCB339D4935B52A969B24E70D6DEAC8946BA9A2B432DC
                                                                                                                                                                                                                          SHA-512:CE2F1709F39683BE4131125BED409103F5EDF1DED545649B186845817C0D69E3D0B832B236F7C4FC09AB7F7BB88E7C9F1E4F7047D1AF56D429752D4D8CBED47A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\login_db

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 2
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):51200
                                                                                                                                                                                                                          Entropy (8bit):0.8745947603342119
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:aZ8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:W8yLG7IwRWf4
                                                                                                                                                                                                                          MD5:378391FDB591852E472D99DC4BF837DA
                                                                                                                                                                                                                          SHA1:10CB2CDAD4EDCCACE0A7748005F52C5251F6F0E0
                                                                                                                                                                                                                          SHA-256:513C63B0E44FFDE2B4E511A69436799A8B59585CB0EB5CCFDA7A9A8F06BA4808
                                                                                                                                                                                                                          SHA-512:F099631BEC265A6E8E4F8808270B57FFF28D7CBF75CC6FA046BB516E8863F36E8506C7A38AD682132FCB1134D26326A58F5B588B9EC9604F09FD7155B2AEF2DA
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\web_history_db

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):155648
                                                                                                                                                                                                                          Entropy (8bit):0.5407252242845243
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:OgWyejzH+bDoYysX0IxQzZkHtpVJNlYDLjGQLBE3CeE0kE:OJhH+bDo3iN0Z2TVJkXBBE3yb
                                                                                                                                                                                                                          MD5:7B955D976803304F2C0505431A0CF1CF
                                                                                                                                                                                                                          SHA1:E29070081B18DA0EF9D98D4389091962E3D37216
                                                                                                                                                                                                                          SHA-256:987FB9BFC2A84C4C605DCB339D4935B52A969B24E70D6DEAC8946BA9A2B432DC
                                                                                                                                                                                                                          SHA-512:CE2F1709F39683BE4131125BED409103F5EDF1DED545649B186845817C0D69E3D0B832B236F7C4FC09AB7F7BB88E7C9F1E4F7047D1AF56D429752D4D8CBED47A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          \Device\Null

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\System32\taskkill.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):44
                                                                                                                                                                                                                          Entropy (8bit):4.261043983337285
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:RLg9duHAFmLKUe9y:RLg9dugMe9y
                                                                                                                                                                                                                          MD5:AD2E5CC5CADCC56B8446CE435BD42CE4
                                                                                                                                                                                                                          SHA1:263793D122F1837B8916BF8623FE5AB4202E1131
                                                                                                                                                                                                                          SHA-256:78609DB3A08FA8D24F189A78895E9E5D49580969F42692E466652EF04EB254B2
                                                                                                                                                                                                                          SHA-512:A66C94FF4709245AD3F37DE98C9418D4AA1AEBE8EC234984E2BD6D80D6E76F7ABD70C0D357722714BB0C355716AFF3CB20970C01BE5FB4453AA3E5A523C9131E
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:ERROR: The process "exodus.exe" not found...

                                                                                                                                                                                                                          Static File Info

                                                                                                                                                                                                                          General

                                                                                                                                                                                                                          File type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Entropy (8bit):7.997371210548079
                                                                                                                                                                                                                          TrID:
                                                                                                                                                                                                                          • Win64 Executable GUI (202006/5) 92.65%
                                                                                                                                                                                                                          • Win64 Executable (generic) (12005/4) 5.51%
                                                                                                                                                                                                                          • Generic Win/DOS Executable (2004/3) 0.92%
                                                                                                                                                                                                                          • DOS Executable Generic (2002/1) 0.92%
                                                                                                                                                                                                                          • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                                                                                                                                                                                          File name:1.exe
                                                                                                                                                                                                                          File size:25'435'744 bytes
                                                                                                                                                                                                                          MD5:3689dace869abbbe4e87f57078f6bec9
                                                                                                                                                                                                                          SHA1:568f5a26f433d55c2628e3e3a5555a9046b19ee3
                                                                                                                                                                                                                          SHA256:610f9a21f99667ede85d082521e7b8150b158b80bc1d13c4498ac095b2316255
                                                                                                                                                                                                                          SHA512:07f18aaa4119df6a7711a8b21157e15473f2b2654fea6eb426857f745cc1b45eb22646c1f754f47cfd07b43b1840d3d31a9762f9354e9db10f06d82552034d2e
                                                                                                                                                                                                                          SSDEEP:393216:nEkQnvgKeQtss27CyDgPYVnNSMtW+eGQRJ93iObIhRS/DW3L8rpJ4s3E6spdp0w:nqjeQtspDgPQHW+e5RT9MhRD3Y9GQIZ
                                                                                                                                                                                                                          TLSH:3247331742624962F9A4013F5006C6245A31AC1177ACF2FA9FB5F8552BFFFAE8A31F44
                                                                                                                                                                                                                          File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........Xhc.Xhc.Xhc...`._hc...f..hc...g.Rhc.....[hc...`.Qhc...g.Ihc...f.phc...b.Shc.Xhb..hc.K.g.Ahc.K.a.Yhc.RichXhc.........PE..d..

                                                                                                                                                                                                                          File Icon

                                                                                                                                                                                                                          Icon Hash:44b27170b2706807

                                                                                                                                                                                                                          Static PE Info

                                                                                                                                                                                                                          General

                                                                                                                                                                                                                          Entrypoint:0x14000c0d0
                                                                                                                                                                                                                          Entrypoint Section:.text
                                                                                                                                                                                                                          Digitally signed:false
                                                                                                                                                                                                                          Imagebase:0x140000000
                                                                                                                                                                                                                          Subsystem:windows gui
                                                                                                                                                                                                                          Image File Characteristics:EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
                                                                                                                                                                                                                          DLL Characteristics:HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
                                                                                                                                                                                                                          Time Stamp:0x66B0ECA1 [Mon Aug 5 15:15:45 2024 UTC]
                                                                                                                                                                                                                          TLS Callbacks:
                                                                                                                                                                                                                          CLR (.Net) Version:
                                                                                                                                                                                                                          OS Version Major:6
                                                                                                                                                                                                                          OS Version Minor:0
                                                                                                                                                                                                                          File Version Major:6
                                                                                                                                                                                                                          File Version Minor:0
                                                                                                                                                                                                                          Subsystem Version Major:6
                                                                                                                                                                                                                          Subsystem Version Minor:0
                                                                                                                                                                                                                          Import Hash:456e8615ad4320c9f54e50319a19df9c

                                                                                                                                                                                                                          Entrypoint Preview

                                                                                                                                                                                                                          Instruction
                                                                                                                                                                                                                          dec eax
                                                                                                                                                                                                                          sub esp, 28h
                                                                                                                                                                                                                          call 00007FFB04B1C8BCh
                                                                                                                                                                                                                          dec eax
                                                                                                                                                                                                                          add esp, 28h
                                                                                                                                                                                                                          jmp 00007FFB04B1C4DFh
                                                                                                                                                                                                                          int3
                                                                                                                                                                                                                          int3
                                                                                                                                                                                                                          int3
                                                                                                                                                                                                                          int3
                                                                                                                                                                                                                          int3
                                                                                                                                                                                                                          int3
                                                                                                                                                                                                                          int3
                                                                                                                                                                                                                          int3
                                                                                                                                                                                                                          int3
                                                                                                                                                                                                                          int3
                                                                                                                                                                                                                          int3
                                                                                                                                                                                                                          int3
                                                                                                                                                                                                                          int3
                                                                                                                                                                                                                          int3
                                                                                                                                                                                                                          dec eax
                                                                                                                                                                                                                          sub esp, 28h
                                                                                                                                                                                                                          call 00007FFB04B1CC88h
                                                                                                                                                                                                                          test eax, eax
                                                                                                                                                                                                                          je 00007FFB04B1C683h
                                                                                                                                                                                                                          dec eax
                                                                                                                                                                                                                          mov eax, dword ptr [00000030h]
                                                                                                                                                                                                                          dec eax
                                                                                                                                                                                                                          mov ecx, dword ptr [eax+08h]
                                                                                                                                                                                                                          jmp 00007FFB04B1C667h
                                                                                                                                                                                                                          dec eax
                                                                                                                                                                                                                          cmp ecx, eax
                                                                                                                                                                                                                          je 00007FFB04B1C676h
                                                                                                                                                                                                                          xor eax, eax
                                                                                                                                                                                                                          dec eax
                                                                                                                                                                                                                          cmpxchg dword ptr [0003843Ch], ecx
                                                                                                                                                                                                                          jne 00007FFB04B1C650h
                                                                                                                                                                                                                          xor al, al
                                                                                                                                                                                                                          dec eax
                                                                                                                                                                                                                          add esp, 28h
                                                                                                                                                                                                                          ret
                                                                                                                                                                                                                          mov al, 01h
                                                                                                                                                                                                                          jmp 00007FFB04B1C659h
                                                                                                                                                                                                                          int3
                                                                                                                                                                                                                          int3
                                                                                                                                                                                                                          int3
                                                                                                                                                                                                                          dec eax
                                                                                                                                                                                                                          sub esp, 28h
                                                                                                                                                                                                                          test ecx, ecx
                                                                                                                                                                                                                          jne 00007FFB04B1C669h
                                                                                                                                                                                                                          mov byte ptr [00038425h], 00000001h
                                                                                                                                                                                                                          call 00007FFB04B1BDB5h
                                                                                                                                                                                                                          call 00007FFB04B1D0A0h
                                                                                                                                                                                                                          test al, al
                                                                                                                                                                                                                          jne 00007FFB04B1C666h
                                                                                                                                                                                                                          xor al, al
                                                                                                                                                                                                                          jmp 00007FFB04B1C676h
                                                                                                                                                                                                                          call 00007FFB04B29BAFh
                                                                                                                                                                                                                          test al, al
                                                                                                                                                                                                                          jne 00007FFB04B1C66Bh
                                                                                                                                                                                                                          xor ecx, ecx
                                                                                                                                                                                                                          call 00007FFB04B1D0B0h
                                                                                                                                                                                                                          jmp 00007FFB04B1C64Ch
                                                                                                                                                                                                                          mov al, 01h
                                                                                                                                                                                                                          dec eax
                                                                                                                                                                                                                          add esp, 28h
                                                                                                                                                                                                                          ret
                                                                                                                                                                                                                          int3
                                                                                                                                                                                                                          int3
                                                                                                                                                                                                                          inc eax
                                                                                                                                                                                                                          push ebx
                                                                                                                                                                                                                          dec eax
                                                                                                                                                                                                                          sub esp, 20h
                                                                                                                                                                                                                          cmp byte ptr [000383ECh], 00000000h
                                                                                                                                                                                                                          mov ebx, ecx
                                                                                                                                                                                                                          jne 00007FFB04B1C6C9h
                                                                                                                                                                                                                          cmp ecx, 01h
                                                                                                                                                                                                                          jnbe 00007FFB04B1C6CCh
                                                                                                                                                                                                                          call 00007FFB04B1CBFEh
                                                                                                                                                                                                                          test eax, eax
                                                                                                                                                                                                                          je 00007FFB04B1C68Ah
                                                                                                                                                                                                                          test ebx, ebx
                                                                                                                                                                                                                          jne 00007FFB04B1C686h
                                                                                                                                                                                                                          dec eax
                                                                                                                                                                                                                          lea ecx, dword ptr [000383D6h]
                                                                                                                                                                                                                          call 00007FFB04B299A2h

                                                                                                                                                                                                                          Data Directories

                                                                                                                                                                                                                          NameVirtual AddressVirtual Size Is in Section
                                                                                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                                                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_IMPORT0x3c76c0x78.rdata
                                                                                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_RESOURCE0x490000xce34.rsrc
                                                                                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_EXCEPTION0x460000x2208.pdata
                                                                                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                                                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_BASERELOC0x560000x768.reloc
                                                                                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_DEBUG0x39dc00x1c.rdata
                                                                                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                                                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x39c800x140.rdata
                                                                                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_IAT0x2b0000x450.rdata
                                                                                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                                                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                                                                                                                                                                          Sections

                                                                                                                                                                                                                          NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                                                                                                                                                          .text0x10000x292100x29400aca64598002ecff9eefbc96554edf015False0.5511067708333334data6.4784482217419175IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                                          .rdata0x2b0000x126420x1280066146420f548cf2acca472542a84c0d8False0.5245460304054054data5.750861752432239IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                                          .data0x3e0000x73d80xe00d0a288978c66419b180b35f625b6dce7False0.13532366071428573data1.8378139998458343IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                                                                          .pdata0x460000x22080x240074cf3ea22e0a1756984435d6f80f7da5False0.4671223958333333data5.259201915045256IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                                          .rsrc0x490000xce340xd000d717912eb54292316bc235b3159acb50False0.042367788461538464data3.816041843179243IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                                          .reloc0x560000x7680x80071de9271648326ec88350e903470cf3eFalse0.5576171875data5.283119454571673IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                                                                                                                                                                                                          Resources

                                                                                                                                                                                                                          NameRVASizeTypeLanguageCountryZLIB Complexity
                                                                                                                                                                                                                          RT_ICON0x490e80xc828Device independent bitmap graphic, 128 x 256 x 24, image size 512000.02777127244340359
                                                                                                                                                                                                                          RT_GROUP_ICON0x559100x14data1.15
                                                                                                                                                                                                                          RT_MANIFEST0x559240x50dXML 1.0 document, ASCII text0.4694508894044857

                                                                                                                                                                                                                          Imports

                                                                                                                                                                                                                          DLLImport
                                                                                                                                                                                                                          USER32.dllCreateWindowExW, PostMessageW, GetMessageW, MessageBoxW, MessageBoxA, SystemParametersInfoW, DestroyIcon, SetWindowLongPtrW, GetWindowLongPtrW, GetClientRect, InvalidateRect, ReleaseDC, GetDC, DrawTextW, GetDialogBaseUnits, EndDialog, DialogBoxIndirectParamW, MoveWindow, SendMessageW
                                                                                                                                                                                                                          COMCTL32.dll
                                                                                                                                                                                                                          KERNEL32.dllGetACP, IsValidCodePage, GetStringTypeW, GetFileAttributesExW, SetEnvironmentVariableW, FlushFileBuffers, GetCurrentDirectoryW, GetOEMCP, GetCPInfo, GetModuleHandleW, MulDiv, GetLastError, FormatMessageW, GetModuleFileNameW, SetDllDirectoryW, CreateSymbolicLinkW, GetProcAddress, CreateDirectoryW, GetCommandLineW, GetEnvironmentVariableW, ExpandEnvironmentStringsW, GetEnvironmentStringsW, FindClose, FindFirstFileW, FindNextFileW, GetDriveTypeW, RemoveDirectoryW, GetTempPathW, CloseHandle, WaitForSingleObject, Sleep, GetCurrentProcess, GetExitCodeProcess, CreateProcessW, GetStartupInfoW, FreeLibrary, LoadLibraryExW, LocalFree, SetConsoleCtrlHandler, K32EnumProcessModules, K32GetModuleFileNameExW, CreateFileW, FindFirstFileExW, GetFinalPathNameByHandleW, MultiByteToWideChar, WideCharToMultiByte, FreeEnvironmentStringsW, GetProcessHeap, GetTimeZoneInformation, HeapSize, HeapReAlloc, WriteConsoleW, SetEndOfFile, DeleteFileW, IsProcessorFeaturePresent, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TerminateProcess, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, RtlUnwindEx, SetLastError, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, EncodePointer, RaiseException, RtlPcToFileHeader, GetCommandLineA, GetFileInformationByHandle, GetFileType, PeekNamedPipe, SystemTimeToTzSpecificLocalTime, FileTimeToSystemTime, ReadFile, GetFullPathNameW, SetStdHandle, GetStdHandle, WriteFile, ExitProcess, GetModuleHandleExW, HeapFree, GetConsoleMode, ReadConsoleW, SetFilePointerEx, GetConsoleOutputCP, GetFileSizeEx, HeapAlloc, FlsAlloc, FlsGetValue, FlsSetValue, FlsFree, CompareStringW, LCMapStringW
                                                                                                                                                                                                                          ADVAPI32.dllOpenProcessToken, GetTokenInformation, ConvertStringSecurityDescriptorToSecurityDescriptorW, ConvertSidToStringSidW
                                                                                                                                                                                                                          GDI32.dllSelectObject, DeleteObject, CreateFontIndirectW

                                                                                                                                                                                                                          Network Behavior

                                                                                                                                                                                                                          Network Port Distribution

                                                                                                                                                                                                                          TCP Packets

                                                                                                                                                                                                                          TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                                                                                          Jan 7, 2025 08:48:07.461747885 CET49722443192.168.2.6151.80.152.246
                                                                                                                                                                                                                          Jan 7, 2025 08:48:07.461782932 CET44349722151.80.152.246192.168.2.6
                                                                                                                                                                                                                          Jan 7, 2025 08:48:07.461841106 CET49722443192.168.2.6151.80.152.246
                                                                                                                                                                                                                          Jan 7, 2025 08:48:07.462821007 CET49722443192.168.2.6151.80.152.246
                                                                                                                                                                                                                          Jan 7, 2025 08:48:07.462830067 CET44349722151.80.152.246192.168.2.6
                                                                                                                                                                                                                          Jan 7, 2025 08:48:08.110584974 CET44349722151.80.152.246192.168.2.6
                                                                                                                                                                                                                          Jan 7, 2025 08:48:08.122260094 CET49722443192.168.2.6151.80.152.246
                                                                                                                                                                                                                          Jan 7, 2025 08:48:08.122283936 CET44349722151.80.152.246192.168.2.6
                                                                                                                                                                                                                          Jan 7, 2025 08:48:08.123703957 CET44349722151.80.152.246192.168.2.6
                                                                                                                                                                                                                          Jan 7, 2025 08:48:08.123784065 CET49722443192.168.2.6151.80.152.246
                                                                                                                                                                                                                          Jan 7, 2025 08:48:08.179410934 CET49722443192.168.2.6151.80.152.246
                                                                                                                                                                                                                          Jan 7, 2025 08:48:08.179601908 CET49722443192.168.2.6151.80.152.246
                                                                                                                                                                                                                          Jan 7, 2025 08:48:11.572527885 CET49749443192.168.2.618.66.112.109
                                                                                                                                                                                                                          Jan 7, 2025 08:48:11.572555065 CET4434974918.66.112.109192.168.2.6
                                                                                                                                                                                                                          Jan 7, 2025 08:48:11.572613955 CET49749443192.168.2.618.66.112.109
                                                                                                                                                                                                                          Jan 7, 2025 08:48:11.572927952 CET49749443192.168.2.618.66.112.109
                                                                                                                                                                                                                          Jan 7, 2025 08:48:11.572940111 CET4434974918.66.112.109192.168.2.6
                                                                                                                                                                                                                          Jan 7, 2025 08:48:12.289802074 CET4434974918.66.112.109192.168.2.6
                                                                                                                                                                                                                          Jan 7, 2025 08:48:12.290292978 CET49749443192.168.2.618.66.112.109
                                                                                                                                                                                                                          Jan 7, 2025 08:48:12.290308952 CET4434974918.66.112.109192.168.2.6
                                                                                                                                                                                                                          Jan 7, 2025 08:48:12.291501045 CET4434974918.66.112.109192.168.2.6
                                                                                                                                                                                                                          Jan 7, 2025 08:48:12.291568995 CET49749443192.168.2.618.66.112.109
                                                                                                                                                                                                                          Jan 7, 2025 08:48:12.293245077 CET49749443192.168.2.618.66.112.109
                                                                                                                                                                                                                          Jan 7, 2025 08:48:12.293323994 CET4434974918.66.112.109192.168.2.6
                                                                                                                                                                                                                          Jan 7, 2025 08:48:12.293394089 CET49749443192.168.2.618.66.112.109
                                                                                                                                                                                                                          Jan 7, 2025 08:48:12.293420076 CET49749443192.168.2.618.66.112.109
                                                                                                                                                                                                                          Jan 7, 2025 08:48:12.309838057 CET4975580192.168.2.6208.95.112.1
                                                                                                                                                                                                                          Jan 7, 2025 08:48:12.314917088 CET8049755208.95.112.1192.168.2.6
                                                                                                                                                                                                                          Jan 7, 2025 08:48:12.314985991 CET4975580192.168.2.6208.95.112.1
                                                                                                                                                                                                                          Jan 7, 2025 08:48:12.315340042 CET4975580192.168.2.6208.95.112.1
                                                                                                                                                                                                                          Jan 7, 2025 08:48:12.320058107 CET8049755208.95.112.1192.168.2.6
                                                                                                                                                                                                                          Jan 7, 2025 08:48:12.781229973 CET8049755208.95.112.1192.168.2.6
                                                                                                                                                                                                                          Jan 7, 2025 08:48:12.782442093 CET4975580192.168.2.6208.95.112.1
                                                                                                                                                                                                                          Jan 7, 2025 08:48:12.788969994 CET8049755208.95.112.1192.168.2.6
                                                                                                                                                                                                                          Jan 7, 2025 08:48:12.789030075 CET4975580192.168.2.6208.95.112.1
                                                                                                                                                                                                                          Jan 7, 2025 08:48:12.874703884 CET49761443192.168.2.6151.80.152.246
                                                                                                                                                                                                                          Jan 7, 2025 08:48:12.874730110 CET44349761151.80.152.246192.168.2.6
                                                                                                                                                                                                                          Jan 7, 2025 08:48:12.874794960 CET49761443192.168.2.6151.80.152.246
                                                                                                                                                                                                                          Jan 7, 2025 08:48:12.875874996 CET49761443192.168.2.6151.80.152.246
                                                                                                                                                                                                                          Jan 7, 2025 08:48:12.875883102 CET44349761151.80.152.246192.168.2.6
                                                                                                                                                                                                                          Jan 7, 2025 08:48:13.502954006 CET44349761151.80.152.246192.168.2.6
                                                                                                                                                                                                                          Jan 7, 2025 08:48:13.579615116 CET49761443192.168.2.6151.80.152.246
                                                                                                                                                                                                                          Jan 7, 2025 08:48:13.816772938 CET49761443192.168.2.6151.80.152.246
                                                                                                                                                                                                                          Jan 7, 2025 08:48:13.816798925 CET44349761151.80.152.246192.168.2.6
                                                                                                                                                                                                                          Jan 7, 2025 08:48:13.818178892 CET44349761151.80.152.246192.168.2.6
                                                                                                                                                                                                                          Jan 7, 2025 08:48:13.818202019 CET44349761151.80.152.246192.168.2.6
                                                                                                                                                                                                                          Jan 7, 2025 08:48:13.818253994 CET49761443192.168.2.6151.80.152.246
                                                                                                                                                                                                                          Jan 7, 2025 08:48:13.851531029 CET49761443192.168.2.6151.80.152.246
                                                                                                                                                                                                                          Jan 7, 2025 08:48:13.851787090 CET44349761151.80.152.246192.168.2.6
                                                                                                                                                                                                                          Jan 7, 2025 08:48:13.851850033 CET49761443192.168.2.6151.80.152.246
                                                                                                                                                                                                                          Jan 7, 2025 08:48:13.880456924 CET49761443192.168.2.6151.80.152.246
                                                                                                                                                                                                                          Jan 7, 2025 08:48:33.097560883 CET49886443192.168.2.634.117.59.81
                                                                                                                                                                                                                          Jan 7, 2025 08:48:33.097604990 CET4434988634.117.59.81192.168.2.6
                                                                                                                                                                                                                          Jan 7, 2025 08:48:33.097734928 CET49886443192.168.2.634.117.59.81
                                                                                                                                                                                                                          Jan 7, 2025 08:48:33.098530054 CET49886443192.168.2.634.117.59.81
                                                                                                                                                                                                                          Jan 7, 2025 08:48:33.098545074 CET4434988634.117.59.81192.168.2.6
                                                                                                                                                                                                                          Jan 7, 2025 08:48:33.571523905 CET4434988634.117.59.81192.168.2.6
                                                                                                                                                                                                                          Jan 7, 2025 08:48:33.572448969 CET49886443192.168.2.634.117.59.81
                                                                                                                                                                                                                          Jan 7, 2025 08:48:33.572460890 CET4434988634.117.59.81192.168.2.6
                                                                                                                                                                                                                          Jan 7, 2025 08:48:33.573498011 CET4434988634.117.59.81192.168.2.6
                                                                                                                                                                                                                          Jan 7, 2025 08:48:33.573575974 CET49886443192.168.2.634.117.59.81
                                                                                                                                                                                                                          Jan 7, 2025 08:48:33.574716091 CET49886443192.168.2.634.117.59.81
                                                                                                                                                                                                                          Jan 7, 2025 08:48:33.574848890 CET4434988634.117.59.81192.168.2.6
                                                                                                                                                                                                                          Jan 7, 2025 08:48:33.574903011 CET49886443192.168.2.634.117.59.81
                                                                                                                                                                                                                          Jan 7, 2025 08:48:33.575242996 CET49886443192.168.2.634.117.59.81
                                                                                                                                                                                                                          Jan 7, 2025 08:48:41.273293018 CET49938443192.168.2.645.112.123.126
                                                                                                                                                                                                                          Jan 7, 2025 08:48:41.273314953 CET4434993845.112.123.126192.168.2.6
                                                                                                                                                                                                                          Jan 7, 2025 08:48:41.273387909 CET49938443192.168.2.645.112.123.126
                                                                                                                                                                                                                          Jan 7, 2025 08:48:41.273825884 CET49938443192.168.2.645.112.123.126
                                                                                                                                                                                                                          Jan 7, 2025 08:48:41.273839951 CET4434993845.112.123.126192.168.2.6
                                                                                                                                                                                                                          Jan 7, 2025 08:48:41.933573008 CET4434993845.112.123.126192.168.2.6
                                                                                                                                                                                                                          Jan 7, 2025 08:48:41.933989048 CET49938443192.168.2.645.112.123.126
                                                                                                                                                                                                                          Jan 7, 2025 08:48:41.934006929 CET4434993845.112.123.126192.168.2.6
                                                                                                                                                                                                                          Jan 7, 2025 08:48:41.934899092 CET4434993845.112.123.126192.168.2.6
                                                                                                                                                                                                                          Jan 7, 2025 08:48:41.934972048 CET49938443192.168.2.645.112.123.126
                                                                                                                                                                                                                          Jan 7, 2025 08:48:41.936156034 CET49938443192.168.2.645.112.123.126
                                                                                                                                                                                                                          Jan 7, 2025 08:48:41.936279058 CET4434993845.112.123.126192.168.2.6
                                                                                                                                                                                                                          Jan 7, 2025 08:48:41.936300039 CET49938443192.168.2.645.112.123.126
                                                                                                                                                                                                                          Jan 7, 2025 08:48:41.936335087 CET49938443192.168.2.645.112.123.126
                                                                                                                                                                                                                          Jan 7, 2025 08:48:42.025039911 CET49943443192.168.2.6144.76.136.153
                                                                                                                                                                                                                          Jan 7, 2025 08:48:42.025079966 CET44349943144.76.136.153192.168.2.6
                                                                                                                                                                                                                          Jan 7, 2025 08:48:42.025161028 CET49943443192.168.2.6144.76.136.153
                                                                                                                                                                                                                          Jan 7, 2025 08:48:42.025623083 CET49943443192.168.2.6144.76.136.153
                                                                                                                                                                                                                          Jan 7, 2025 08:48:42.025636911 CET44349943144.76.136.153192.168.2.6
                                                                                                                                                                                                                          Jan 7, 2025 08:49:24.768923044 CET44349943144.76.136.153192.168.2.6
                                                                                                                                                                                                                          Jan 7, 2025 08:49:24.769174099 CET49943443192.168.2.6144.76.136.153
                                                                                                                                                                                                                          Jan 7, 2025 08:49:24.769242048 CET49943443192.168.2.6144.76.136.153
                                                                                                                                                                                                                          Jan 7, 2025 08:49:24.769258022 CET44349943144.76.136.153192.168.2.6

                                                                                                                                                                                                                          UDP Packets

                                                                                                                                                                                                                          TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                                                                                          Jan 7, 2025 08:48:07.429990053 CET6445153192.168.2.61.1.1.1
                                                                                                                                                                                                                          Jan 7, 2025 08:48:07.454803944 CET53644511.1.1.1192.168.2.6
                                                                                                                                                                                                                          Jan 7, 2025 08:48:11.565023899 CET6128053192.168.2.61.1.1.1
                                                                                                                                                                                                                          Jan 7, 2025 08:48:11.571553946 CET53612801.1.1.1192.168.2.6
                                                                                                                                                                                                                          Jan 7, 2025 08:48:12.302392006 CET5348053192.168.2.61.1.1.1
                                                                                                                                                                                                                          Jan 7, 2025 08:48:12.308986902 CET53534801.1.1.1192.168.2.6
                                                                                                                                                                                                                          Jan 7, 2025 08:48:33.089885950 CET5609253192.168.2.61.1.1.1
                                                                                                                                                                                                                          Jan 7, 2025 08:48:33.096765995 CET53560921.1.1.1192.168.2.6
                                                                                                                                                                                                                          Jan 7, 2025 08:48:41.263360023 CET6132753192.168.2.61.1.1.1
                                                                                                                                                                                                                          Jan 7, 2025 08:48:41.270886898 CET53613271.1.1.1192.168.2.6
                                                                                                                                                                                                                          Jan 7, 2025 08:48:41.992436886 CET5529953192.168.2.61.1.1.1
                                                                                                                                                                                                                          Jan 7, 2025 08:48:42.024147034 CET53552991.1.1.1192.168.2.6

                                                                                                                                                                                                                          DNS Queries

                                                                                                                                                                                                                          TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                                                                                                                                                                                          Jan 7, 2025 08:48:07.429990053 CET192.168.2.61.1.1.10xc1e0Standard query (0)idefasoft.frA (IP address)IN (0x0001)false
                                                                                                                                                                                                                          Jan 7, 2025 08:48:11.565023899 CET192.168.2.61.1.1.10x5b28Standard query (0)tiktok.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                          Jan 7, 2025 08:48:12.302392006 CET192.168.2.61.1.1.10x5e71Standard query (0)ip-api.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                          Jan 7, 2025 08:48:33.089885950 CET192.168.2.61.1.1.10xcdfStandard query (0)ipinfo.ioA (IP address)IN (0x0001)false
                                                                                                                                                                                                                          Jan 7, 2025 08:48:41.263360023 CET192.168.2.61.1.1.10x7f63Standard query (0)api.gofile.ioA (IP address)IN (0x0001)false
                                                                                                                                                                                                                          Jan 7, 2025 08:48:41.992436886 CET192.168.2.61.1.1.10x3775Standard query (0)transfer.shA (IP address)IN (0x0001)false

                                                                                                                                                                                                                          DNS Answers

                                                                                                                                                                                                                          TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                                                                                                                                                                                          Jan 7, 2025 08:48:07.454803944 CET1.1.1.1192.168.2.60xc1e0No error (0)idefasoft.fr151.80.152.246A (IP address)IN (0x0001)false
                                                                                                                                                                                                                          Jan 7, 2025 08:48:11.571553946 CET1.1.1.1192.168.2.60x5b28No error (0)tiktok.com18.66.112.109A (IP address)IN (0x0001)false
                                                                                                                                                                                                                          Jan 7, 2025 08:48:11.571553946 CET1.1.1.1192.168.2.60x5b28No error (0)tiktok.com18.66.112.128A (IP address)IN (0x0001)false
                                                                                                                                                                                                                          Jan 7, 2025 08:48:11.571553946 CET1.1.1.1192.168.2.60x5b28No error (0)tiktok.com18.66.112.28A (IP address)IN (0x0001)false
                                                                                                                                                                                                                          Jan 7, 2025 08:48:11.571553946 CET1.1.1.1192.168.2.60x5b28No error (0)tiktok.com18.66.112.57A (IP address)IN (0x0001)false
                                                                                                                                                                                                                          Jan 7, 2025 08:48:12.308986902 CET1.1.1.1192.168.2.60x5e71No error (0)ip-api.com208.95.112.1A (IP address)IN (0x0001)false
                                                                                                                                                                                                                          Jan 7, 2025 08:48:33.096765995 CET1.1.1.1192.168.2.60xcdfNo error (0)ipinfo.io34.117.59.81A (IP address)IN (0x0001)false
                                                                                                                                                                                                                          Jan 7, 2025 08:48:41.270886898 CET1.1.1.1192.168.2.60x7f63No error (0)api.gofile.io45.112.123.126A (IP address)IN (0x0001)false
                                                                                                                                                                                                                          Jan 7, 2025 08:48:42.024147034 CET1.1.1.1192.168.2.60x3775No error (0)transfer.sh144.76.136.153A (IP address)IN (0x0001)false

                                                                                                                                                                                                                          HTTP Request Dependency Graph

                                                                                                                                                                                                                          • ip-api.com

                                                                                                                                                                                                                          HTTP Packets

                                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                          0192.168.2.649755208.95.112.1802304C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                                          Jan 7, 2025 08:48:12.315340042 CET167OUTGET /json/?fields=hosting,query HTTP/1.1
                                                                                                                                                                                                                          Host: ip-api.com
                                                                                                                                                                                                                          User-Agent: python-requests/2.32.3
                                                                                                                                                                                                                          Accept-Encoding: gzip, deflate
                                                                                                                                                                                                                          Accept: */*
                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                          Jan 7, 2025 08:48:12.781229973 CET216INHTTP/1.1 200 OK
                                                                                                                                                                                                                          Date: Tue, 07 Jan 2025 07:48:12 GMT
                                                                                                                                                                                                                          Content-Type: application/json; charset=utf-8
                                                                                                                                                                                                                          Content-Length: 40
                                                                                                                                                                                                                          Access-Control-Allow-Origin: *
                                                                                                                                                                                                                          X-Ttl: 60
                                                                                                                                                                                                                          X-Rl: 44
                                                                                                                                                                                                                          Data Raw: 7b 22 68 6f 73 74 69 6e 67 22 3a 66 61 6c 73 65 2c 22 71 75 65 72 79 22 3a 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 7d
                                                                                                                                                                                                                          Data Ascii: {"hosting":false,"query":"8.46.123.189"}


                                                                                                                                                                                                                          Statistics

                                                                                                                                                                                                                          CPU Usage

                                                                                                                                                                                                                          Click to jump to process

                                                                                                                                                                                                                          Memory Usage

                                                                                                                                                                                                                          Click to jump to process

                                                                                                                                                                                                                          High Level Behavior Distribution

                                                                                                                                                                                                                          Click to dive into process behavior distribution

                                                                                                                                                                                                                          Behavior

                                                                                                                                                                                                                          Click to jump to process

                                                                                                                                                                                                                          System Behavior

                                                                                                                                                                                                                          General

                                                                                                                                                                                                                          Target ID:0
                                                                                                                                                                                                                          Start time:02:47:56
                                                                                                                                                                                                                          Start date:07/01/2025
                                                                                                                                                                                                                          Path:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                                                                          Commandline:"C:\Users\user\Desktop\1.exe"
                                                                                                                                                                                                                          Imagebase:0x7ff7e93a0000
                                                                                                                                                                                                                          File size:25'435'744 bytes
                                                                                                                                                                                                                          MD5 hash:3689DACE869ABBBE4E87F57078F6BEC9
                                                                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                                          Reputation:low
                                                                                                                                                                                                                          Has exited:true

                                                                                                                                                                                                                          General

                                                                                                                                                                                                                          Target ID:2
                                                                                                                                                                                                                          Start time:02:48:00
                                                                                                                                                                                                                          Start date:07/01/2025
                                                                                                                                                                                                                          Path:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                                                                          Commandline:"C:\Users\user\Desktop\1.exe"
                                                                                                                                                                                                                          Imagebase:0x7ff7e93a0000
                                                                                                                                                                                                                          File size:25'435'744 bytes
                                                                                                                                                                                                                          MD5 hash:3689DACE869ABBBE4E87F57078F6BEC9
                                                                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                                          Reputation:low
                                                                                                                                                                                                                          Has exited:true

                                                                                                                                                                                                                          General

                                                                                                                                                                                                                          Target ID:4
                                                                                                                                                                                                                          Start time:02:48:03
                                                                                                                                                                                                                          Start date:07/01/2025
                                                                                                                                                                                                                          Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                                                                          Commandline:C:\Windows\system32\cmd.exe /c "ver"
                                                                                                                                                                                                                          Imagebase:0x7ff789530000
                                                                                                                                                                                                                          File size:289'792 bytes
                                                                                                                                                                                                                          MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                                          Reputation:high
                                                                                                                                                                                                                          Has exited:true

                                                                                                                                                                                                                          General

                                                                                                                                                                                                                          Target ID:5
                                                                                                                                                                                                                          Start time:02:48:03
                                                                                                                                                                                                                          Start date:07/01/2025
                                                                                                                                                                                                                          Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                                                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                          Imagebase:0x7ff66e660000
                                                                                                                                                                                                                          File size:862'208 bytes
                                                                                                                                                                                                                          MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                                          Reputation:high
                                                                                                                                                                                                                          Has exited:true

                                                                                                                                                                                                                          General

                                                                                                                                                                                                                          Target ID:6
                                                                                                                                                                                                                          Start time:02:48:07
                                                                                                                                                                                                                          Start date:07/01/2025
                                                                                                                                                                                                                          Path:C:\Windows\System32\wbem\WMIC.exe
                                                                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                                                                          Commandline:wmic path win32_VideoController get name
                                                                                                                                                                                                                          Imagebase:0x7ff7f1cb0000
                                                                                                                                                                                                                          File size:576'000 bytes
                                                                                                                                                                                                                          MD5 hash:C37F2F4F4B3CD128BDABCAEB2266A785
                                                                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                                          Reputation:high
                                                                                                                                                                                                                          Has exited:true

                                                                                                                                                                                                                          General

                                                                                                                                                                                                                          Target ID:7
                                                                                                                                                                                                                          Start time:02:48:07
                                                                                                                                                                                                                          Start date:07/01/2025
                                                                                                                                                                                                                          Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                                                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                          Imagebase:0x7ff66e660000
                                                                                                                                                                                                                          File size:862'208 bytes
                                                                                                                                                                                                                          MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                                          Reputation:high
                                                                                                                                                                                                                          Has exited:true

                                                                                                                                                                                                                          General

                                                                                                                                                                                                                          Target ID:8
                                                                                                                                                                                                                          Start time:02:48:08
                                                                                                                                                                                                                          Start date:07/01/2025
                                                                                                                                                                                                                          Path:C:\Windows\System32\wbem\WMIC.exe
                                                                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                                                                          Commandline:wmic csproduct get uuid
                                                                                                                                                                                                                          Imagebase:0x7ff7f1cb0000
                                                                                                                                                                                                                          File size:576'000 bytes
                                                                                                                                                                                                                          MD5 hash:C37F2F4F4B3CD128BDABCAEB2266A785
                                                                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                                          Reputation:high
                                                                                                                                                                                                                          Has exited:true

                                                                                                                                                                                                                          General

                                                                                                                                                                                                                          Target ID:9
                                                                                                                                                                                                                          Start time:02:48:08
                                                                                                                                                                                                                          Start date:07/01/2025
                                                                                                                                                                                                                          Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                                                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                          Imagebase:0x7ff66e660000
                                                                                                                                                                                                                          File size:862'208 bytes
                                                                                                                                                                                                                          MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                                          Reputation:high
                                                                                                                                                                                                                          Has exited:true

                                                                                                                                                                                                                          General

                                                                                                                                                                                                                          Target ID:10
                                                                                                                                                                                                                          Start time:02:48:09
                                                                                                                                                                                                                          Start date:07/01/2025
                                                                                                                                                                                                                          Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                                                                          Commandline:C:\Windows\system32\cmd.exe /c REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2> nul
                                                                                                                                                                                                                          Imagebase:0x7ff789530000
                                                                                                                                                                                                                          File size:289'792 bytes
                                                                                                                                                                                                                          MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                                          Reputation:high
                                                                                                                                                                                                                          Has exited:true

                                                                                                                                                                                                                          General

                                                                                                                                                                                                                          Target ID:11
                                                                                                                                                                                                                          Start time:02:48:09
                                                                                                                                                                                                                          Start date:07/01/2025
                                                                                                                                                                                                                          Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                                                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                          Imagebase:0x7ff66e660000
                                                                                                                                                                                                                          File size:862'208 bytes
                                                                                                                                                                                                                          MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                                          Reputation:high
                                                                                                                                                                                                                          Has exited:true

                                                                                                                                                                                                                          General

                                                                                                                                                                                                                          Target ID:12
                                                                                                                                                                                                                          Start time:02:48:09
                                                                                                                                                                                                                          Start date:07/01/2025
                                                                                                                                                                                                                          Path:C:\Windows\System32\reg.exe
                                                                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                                                                          Commandline:REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc
                                                                                                                                                                                                                          Imagebase:0x7ff7f3020000
                                                                                                                                                                                                                          File size:77'312 bytes
                                                                                                                                                                                                                          MD5 hash:227F63E1D9008B36BDBCC4B397780BE4
                                                                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                                          Reputation:high
                                                                                                                                                                                                                          Has exited:true

                                                                                                                                                                                                                          General

                                                                                                                                                                                                                          Target ID:13
                                                                                                                                                                                                                          Start time:02:48:09
                                                                                                                                                                                                                          Start date:07/01/2025
                                                                                                                                                                                                                          Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                                                                          Commandline:C:\Windows\system32\cmd.exe /c REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2> nul
                                                                                                                                                                                                                          Imagebase:0x7ff66e660000
                                                                                                                                                                                                                          File size:289'792 bytes
                                                                                                                                                                                                                          MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                                          Reputation:high
                                                                                                                                                                                                                          Has exited:true

                                                                                                                                                                                                                          General

                                                                                                                                                                                                                          Target ID:14
                                                                                                                                                                                                                          Start time:02:48:09
                                                                                                                                                                                                                          Start date:07/01/2025
                                                                                                                                                                                                                          Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                                                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                          Imagebase:0x7ff66e660000
                                                                                                                                                                                                                          File size:862'208 bytes
                                                                                                                                                                                                                          MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                                          Has exited:true

                                                                                                                                                                                                                          General

                                                                                                                                                                                                                          Target ID:15
                                                                                                                                                                                                                          Start time:02:48:09
                                                                                                                                                                                                                          Start date:07/01/2025
                                                                                                                                                                                                                          Path:C:\Windows\System32\reg.exe
                                                                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                                                                          Commandline:REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName
                                                                                                                                                                                                                          Imagebase:0x7ff7f3020000
                                                                                                                                                                                                                          File size:77'312 bytes
                                                                                                                                                                                                                          MD5 hash:227F63E1D9008B36BDBCC4B397780BE4
                                                                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                                          Has exited:true

                                                                                                                                                                                                                          General

                                                                                                                                                                                                                          Target ID:17
                                                                                                                                                                                                                          Start time:02:48:12
                                                                                                                                                                                                                          Start date:07/01/2025
                                                                                                                                                                                                                          Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                                                                          Commandline:C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
                                                                                                                                                                                                                          Imagebase:0x7ff789530000
                                                                                                                                                                                                                          File size:289'792 bytes
                                                                                                                                                                                                                          MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                                          Has exited:true

                                                                                                                                                                                                                          General

                                                                                                                                                                                                                          Target ID:18
                                                                                                                                                                                                                          Start time:02:48:12
                                                                                                                                                                                                                          Start date:07/01/2025
                                                                                                                                                                                                                          Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                                                                          Commandline:C:\Windows\system32\cmd.exe /c "tasklist"
                                                                                                                                                                                                                          Imagebase:0x7ff789530000
                                                                                                                                                                                                                          File size:289'792 bytes
                                                                                                                                                                                                                          MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                                          Has exited:true

                                                                                                                                                                                                                          General

                                                                                                                                                                                                                          Target ID:19
                                                                                                                                                                                                                          Start time:02:48:12
                                                                                                                                                                                                                          Start date:07/01/2025
                                                                                                                                                                                                                          Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                                                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                          Imagebase:0x7ff66e660000
                                                                                                                                                                                                                          File size:862'208 bytes
                                                                                                                                                                                                                          MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                                          Has exited:true

                                                                                                                                                                                                                          General

                                                                                                                                                                                                                          Target ID:20
                                                                                                                                                                                                                          Start time:02:48:12
                                                                                                                                                                                                                          Start date:07/01/2025
                                                                                                                                                                                                                          Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                                                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                          Imagebase:0x7ff66e660000
                                                                                                                                                                                                                          File size:862'208 bytes
                                                                                                                                                                                                                          MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                                          Has exited:true

                                                                                                                                                                                                                          General

                                                                                                                                                                                                                          Target ID:21
                                                                                                                                                                                                                          Start time:02:48:12
                                                                                                                                                                                                                          Start date:07/01/2025
                                                                                                                                                                                                                          Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                                                                          Commandline:C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
                                                                                                                                                                                                                          Imagebase:0x7ff789530000
                                                                                                                                                                                                                          File size:289'792 bytes
                                                                                                                                                                                                                          MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                                          Has exited:true

                                                                                                                                                                                                                          General

                                                                                                                                                                                                                          Target ID:22
                                                                                                                                                                                                                          Start time:02:48:12
                                                                                                                                                                                                                          Start date:07/01/2025
                                                                                                                                                                                                                          Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                                                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                          Imagebase:0x7ff66e660000
                                                                                                                                                                                                                          File size:862'208 bytes
                                                                                                                                                                                                                          MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                                          Has exited:true

                                                                                                                                                                                                                          General

                                                                                                                                                                                                                          Target ID:23
                                                                                                                                                                                                                          Start time:02:48:12
                                                                                                                                                                                                                          Start date:07/01/2025
                                                                                                                                                                                                                          Path:C:\Windows\System32\tasklist.exe
                                                                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                                                                          Commandline:tasklist
                                                                                                                                                                                                                          Imagebase:0x7ff635ac0000
                                                                                                                                                                                                                          File size:106'496 bytes
                                                                                                                                                                                                                          MD5 hash:D0A49A170E13D7F6AEBBEFED9DF88AAA
                                                                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                                          Has exited:true

                                                                                                                                                                                                                          General

                                                                                                                                                                                                                          Target ID:24
                                                                                                                                                                                                                          Start time:02:48:12
                                                                                                                                                                                                                          Start date:07/01/2025
                                                                                                                                                                                                                          Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                                                                          Commandline:powershell Get-Clipboard
                                                                                                                                                                                                                          Imagebase:0x7ff6e3d50000
                                                                                                                                                                                                                          File size:452'608 bytes
                                                                                                                                                                                                                          MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                                          Has exited:true

                                                                                                                                                                                                                          General

                                                                                                                                                                                                                          Target ID:25
                                                                                                                                                                                                                          Start time:02:48:12
                                                                                                                                                                                                                          Start date:07/01/2025
                                                                                                                                                                                                                          Path:C:\Windows\System32\wbem\WMIC.exe
                                                                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                                                                          Commandline:WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
                                                                                                                                                                                                                          Imagebase:0x7ff7f1cb0000
                                                                                                                                                                                                                          File size:576'000 bytes
                                                                                                                                                                                                                          MD5 hash:C37F2F4F4B3CD128BDABCAEB2266A785
                                                                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                                          Has exited:true

                                                                                                                                                                                                                          General

                                                                                                                                                                                                                          Target ID:26
                                                                                                                                                                                                                          Start time:02:48:13
                                                                                                                                                                                                                          Start date:07/01/2025
                                                                                                                                                                                                                          Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                                                                          Commandline:C:\Windows\system32\cmd.exe /c "taskkill /f /im exodus.exe"
                                                                                                                                                                                                                          Imagebase:0x7ff789530000
                                                                                                                                                                                                                          File size:289'792 bytes
                                                                                                                                                                                                                          MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                                          Has exited:true

                                                                                                                                                                                                                          General

                                                                                                                                                                                                                          Target ID:27
                                                                                                                                                                                                                          Start time:02:48:13
                                                                                                                                                                                                                          Start date:07/01/2025
                                                                                                                                                                                                                          Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                                                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                          Imagebase:0x7ff66e660000
                                                                                                                                                                                                                          File size:862'208 bytes
                                                                                                                                                                                                                          MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                                          Has exited:true

                                                                                                                                                                                                                          General

                                                                                                                                                                                                                          Target ID:28
                                                                                                                                                                                                                          Start time:02:48:14
                                                                                                                                                                                                                          Start date:07/01/2025
                                                                                                                                                                                                                          Path:C:\Windows\System32\taskkill.exe
                                                                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                                                                          Commandline:taskkill /f /im exodus.exe
                                                                                                                                                                                                                          Imagebase:0x7ff6114d0000
                                                                                                                                                                                                                          File size:101'376 bytes
                                                                                                                                                                                                                          MD5 hash:A599D3B2FAFBDE4C1A6D7D0F839451C7
                                                                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                                          Has exited:true

                                                                                                                                                                                                                          General

                                                                                                                                                                                                                          Target ID:29
                                                                                                                                                                                                                          Start time:02:48:16
                                                                                                                                                                                                                          Start date:07/01/2025
                                                                                                                                                                                                                          Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                                                                          Commandline:powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
                                                                                                                                                                                                                          Imagebase:0x7ff6e3d50000
                                                                                                                                                                                                                          File size:452'608 bytes
                                                                                                                                                                                                                          MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                                          Has exited:true

                                                                                                                                                                                                                          General

                                                                                                                                                                                                                          Target ID:30
                                                                                                                                                                                                                          Start time:02:48:16
                                                                                                                                                                                                                          Start date:07/01/2025
                                                                                                                                                                                                                          Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                                                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                          Imagebase:0x7ff66e660000
                                                                                                                                                                                                                          File size:862'208 bytes
                                                                                                                                                                                                                          MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                                          Has exited:true

                                                                                                                                                                                                                          General

                                                                                                                                                                                                                          Target ID:31
                                                                                                                                                                                                                          Start time:02:48:20
                                                                                                                                                                                                                          Start date:07/01/2025
                                                                                                                                                                                                                          Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                                                                          Commandline:powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
                                                                                                                                                                                                                          Imagebase:0x7ff6e3d50000
                                                                                                                                                                                                                          File size:452'608 bytes
                                                                                                                                                                                                                          MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                                          Has exited:true

                                                                                                                                                                                                                          General

                                                                                                                                                                                                                          Target ID:32
                                                                                                                                                                                                                          Start time:02:48:20
                                                                                                                                                                                                                          Start date:07/01/2025
                                                                                                                                                                                                                          Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                                                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                          Imagebase:0x7ff66e660000
                                                                                                                                                                                                                          File size:862'208 bytes
                                                                                                                                                                                                                          MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                                          Has exited:true

                                                                                                                                                                                                                          General

                                                                                                                                                                                                                          Target ID:33
                                                                                                                                                                                                                          Start time:02:48:27
                                                                                                                                                                                                                          Start date:07/01/2025
                                                                                                                                                                                                                          Path:C:\Windows\System32\wbem\WMIC.exe
                                                                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                                                                          Commandline:wmic cpu get name
                                                                                                                                                                                                                          Imagebase:0x7ff7f1cb0000
                                                                                                                                                                                                                          File size:576'000 bytes
                                                                                                                                                                                                                          MD5 hash:C37F2F4F4B3CD128BDABCAEB2266A785
                                                                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                                          Has exited:true

                                                                                                                                                                                                                          General

                                                                                                                                                                                                                          Target ID:34
                                                                                                                                                                                                                          Start time:02:48:27
                                                                                                                                                                                                                          Start date:07/01/2025
                                                                                                                                                                                                                          Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                                                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                          Imagebase:0x7ff66e660000
                                                                                                                                                                                                                          File size:862'208 bytes
                                                                                                                                                                                                                          MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                                          Has exited:true

                                                                                                                                                                                                                          General

                                                                                                                                                                                                                          Target ID:35
                                                                                                                                                                                                                          Start time:02:48:28
                                                                                                                                                                                                                          Start date:07/01/2025
                                                                                                                                                                                                                          Path:C:\Windows\System32\wbem\WMIC.exe
                                                                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                                                                          Commandline:wmic path win32_VideoController get name
                                                                                                                                                                                                                          Imagebase:0x7ff7f1cb0000
                                                                                                                                                                                                                          File size:576'000 bytes
                                                                                                                                                                                                                          MD5 hash:C37F2F4F4B3CD128BDABCAEB2266A785
                                                                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                                          Has exited:true

                                                                                                                                                                                                                          General

                                                                                                                                                                                                                          Target ID:36
                                                                                                                                                                                                                          Start time:02:48:28
                                                                                                                                                                                                                          Start date:07/01/2025
                                                                                                                                                                                                                          Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                                                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                          Imagebase:0x7ff66e660000
                                                                                                                                                                                                                          File size:862'208 bytes
                                                                                                                                                                                                                          MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                                          Has exited:true

                                                                                                                                                                                                                          General

                                                                                                                                                                                                                          Target ID:37
                                                                                                                                                                                                                          Start time:02:48:29
                                                                                                                                                                                                                          Start date:07/01/2025
                                                                                                                                                                                                                          Path:C:\Windows\System32\wbem\WMIC.exe
                                                                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                                                                          Commandline:wmic computersystem get TotalPhysicalMemory
                                                                                                                                                                                                                          Imagebase:0x7ff7f1cb0000
                                                                                                                                                                                                                          File size:576'000 bytes
                                                                                                                                                                                                                          MD5 hash:C37F2F4F4B3CD128BDABCAEB2266A785
                                                                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                                          Has exited:true

                                                                                                                                                                                                                          General

                                                                                                                                                                                                                          Target ID:38
                                                                                                                                                                                                                          Start time:02:48:29
                                                                                                                                                                                                                          Start date:07/01/2025
                                                                                                                                                                                                                          Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                                                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                          Imagebase:0x7ff66e660000
                                                                                                                                                                                                                          File size:862'208 bytes
                                                                                                                                                                                                                          MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                                          Has exited:true

                                                                                                                                                                                                                          General

                                                                                                                                                                                                                          Target ID:39
                                                                                                                                                                                                                          Start time:02:48:30
                                                                                                                                                                                                                          Start date:07/01/2025
                                                                                                                                                                                                                          Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                                                                          Commandline:C:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\WMIC.exe csproduct get uuid"
                                                                                                                                                                                                                          Imagebase:0x7ff789530000
                                                                                                                                                                                                                          File size:289'792 bytes
                                                                                                                                                                                                                          MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                                          Has exited:true

                                                                                                                                                                                                                          General

                                                                                                                                                                                                                          Target ID:40
                                                                                                                                                                                                                          Start time:02:48:30
                                                                                                                                                                                                                          Start date:07/01/2025
                                                                                                                                                                                                                          Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                                                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                          Imagebase:0x7ff66e660000
                                                                                                                                                                                                                          File size:862'208 bytes
                                                                                                                                                                                                                          MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                                          Has exited:true

                                                                                                                                                                                                                          General

                                                                                                                                                                                                                          Target ID:42
                                                                                                                                                                                                                          Start time:02:48:30
                                                                                                                                                                                                                          Start date:07/01/2025
                                                                                                                                                                                                                          Path:C:\Windows\System32\wbem\WMIC.exe
                                                                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                                                                          Commandline:C:\Windows\System32\wbem\WMIC.exe csproduct get uuid
                                                                                                                                                                                                                          Imagebase:0x7ff7f1cb0000
                                                                                                                                                                                                                          File size:576'000 bytes
                                                                                                                                                                                                                          MD5 hash:C37F2F4F4B3CD128BDABCAEB2266A785
                                                                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                                          Has exited:true

                                                                                                                                                                                                                          Disassembly

                                                                                                                                                                                                                          Reset < >

                                                                                                                                                                                                                            Execution Graph

                                                                                                                                                                                                                            Execution Coverage:10.5%
                                                                                                                                                                                                                            Dynamic/Decrypted Code Coverage:0%
                                                                                                                                                                                                                            Signature Coverage:19.2%
                                                                                                                                                                                                                            Total number of Nodes:2000
                                                                                                                                                                                                                            Total number of Limit Nodes:73
                                                                                                                                                                                                                            execution_graph 19318 7ff7e93b9060 19321 7ff7e93b8fe4 19318->19321 19328 7ff7e93bf5e8 EnterCriticalSection 19321->19328 19739 7ff7e93ba2e0 19740 7ff7e93ba2fa 19739->19740 19741 7ff7e93ba2e5 19739->19741 19745 7ff7e93ba300 19741->19745 19746 7ff7e93ba342 19745->19746 19747 7ff7e93ba34a 19745->19747 19748 7ff7e93b9c58 __free_lconv_mon 11 API calls 19746->19748 19749 7ff7e93b9c58 __free_lconv_mon 11 API calls 19747->19749 19748->19747 19750 7ff7e93ba357 19749->19750 19751 7ff7e93b9c58 __free_lconv_mon 11 API calls 19750->19751 19752 7ff7e93ba364 19751->19752 19753 7ff7e93b9c58 __free_lconv_mon 11 API calls 19752->19753 19754 7ff7e93ba371 19753->19754 19755 7ff7e93b9c58 __free_lconv_mon 11 API calls 19754->19755 19756 7ff7e93ba37e 19755->19756 19757 7ff7e93b9c58 __free_lconv_mon 11 API calls 19756->19757 19758 7ff7e93ba38b 19757->19758 19759 7ff7e93b9c58 __free_lconv_mon 11 API calls 19758->19759 19760 7ff7e93ba398 19759->19760 19761 7ff7e93b9c58 __free_lconv_mon 11 API calls 19760->19761 19762 7ff7e93ba3a5 19761->19762 19763 7ff7e93b9c58 __free_lconv_mon 11 API calls 19762->19763 19764 7ff7e93ba3b5 19763->19764 19765 7ff7e93b9c58 __free_lconv_mon 11 API calls 19764->19765 19766 7ff7e93ba3c5 19765->19766 19771 7ff7e93ba1a4 19766->19771 19785 7ff7e93bf5e8 EnterCriticalSection 19771->19785 15981 7ff7e93bfbd8 15982 7ff7e93bfbfc 15981->15982 15984 7ff7e93bfc0c 15981->15984 15983 7ff7e93b43f4 _get_daylight 11 API calls 15982->15983 16003 7ff7e93bfc01 15983->16003 15985 7ff7e93bfeec 15984->15985 15986 7ff7e93bfc2e 15984->15986 15987 7ff7e93b43f4 _get_daylight 11 API calls 15985->15987 15988 7ff7e93bfc4f 15986->15988 16130 7ff7e93c0294 15986->16130 15989 7ff7e93bfef1 15987->15989 15992 7ff7e93bfcc1 15988->15992 15994 7ff7e93bfc75 15988->15994 15999 7ff7e93bfcb5 15988->15999 15991 7ff7e93b9c58 __free_lconv_mon 11 API calls 15989->15991 15991->16003 15996 7ff7e93bdea8 _get_daylight 11 API calls 15992->15996 16013 7ff7e93bfc84 15992->16013 15993 7ff7e93bfd6e 16002 7ff7e93bfd8b 15993->16002 16010 7ff7e93bfddd 15993->16010 16145 7ff7e93b89d8 15994->16145 16000 7ff7e93bfcd7 15996->16000 15998 7ff7e93b9c58 __free_lconv_mon 11 API calls 15998->16003 15999->15993 15999->16013 16151 7ff7e93c643c 15999->16151 16004 7ff7e93b9c58 __free_lconv_mon 11 API calls 16000->16004 16007 7ff7e93b9c58 __free_lconv_mon 11 API calls 16002->16007 16008 7ff7e93bfce5 16004->16008 16005 7ff7e93bfc7f 16009 7ff7e93b43f4 _get_daylight 11 API calls 16005->16009 16006 7ff7e93bfc9d 16006->15999 16012 7ff7e93c0294 45 API calls 16006->16012 16011 7ff7e93bfd94 16007->16011 16008->15999 16008->16013 16016 7ff7e93bdea8 _get_daylight 11 API calls 16008->16016 16009->16013 16010->16013 16014 7ff7e93c26ec 40 API calls 16010->16014 16023 7ff7e93bfd99 16011->16023 16187 7ff7e93c26ec 16011->16187 16012->15999 16013->15998 16015 7ff7e93bfe1a 16014->16015 16017 7ff7e93b9c58 __free_lconv_mon 11 API calls 16015->16017 16019 7ff7e93bfd07 16016->16019 16021 7ff7e93bfe24 16017->16021 16020 7ff7e93b9c58 __free_lconv_mon 11 API calls 16019->16020 16020->15999 16021->16013 16021->16023 16022 7ff7e93bfee0 16025 7ff7e93b9c58 __free_lconv_mon 11 API calls 16022->16025 16023->16022 16027 7ff7e93bdea8 _get_daylight 11 API calls 16023->16027 16024 7ff7e93bfdc5 16026 7ff7e93b9c58 __free_lconv_mon 11 API calls 16024->16026 16025->16003 16026->16023 16028 7ff7e93bfe68 16027->16028 16029 7ff7e93bfe70 16028->16029 16030 7ff7e93bfe79 16028->16030 16032 7ff7e93b9c58 __free_lconv_mon 11 API calls 16029->16032 16112 7ff7e93b97b4 16030->16112 16034 7ff7e93bfe77 16032->16034 16039 7ff7e93b9c58 __free_lconv_mon 11 API calls 16034->16039 16035 7ff7e93bfe90 16196 7ff7e93c6554 16035->16196 16036 7ff7e93bff1b 16038 7ff7e93b9c10 _isindst 17 API calls 16036->16038 16041 7ff7e93bff2f 16038->16041 16039->16003 16044 7ff7e93bff58 16041->16044 16050 7ff7e93bff68 16041->16050 16042 7ff7e93bfed8 16047 7ff7e93b9c58 __free_lconv_mon 11 API calls 16042->16047 16043 7ff7e93bfeb7 16045 7ff7e93b43f4 _get_daylight 11 API calls 16043->16045 16046 7ff7e93b43f4 _get_daylight 11 API calls 16044->16046 16048 7ff7e93bfebc 16045->16048 16049 7ff7e93bff5d 16046->16049 16047->16022 16052 7ff7e93b9c58 __free_lconv_mon 11 API calls 16048->16052 16051 7ff7e93c024b 16050->16051 16053 7ff7e93bff8a 16050->16053 16054 7ff7e93b43f4 _get_daylight 11 API calls 16051->16054 16052->16034 16055 7ff7e93bffa7 16053->16055 16215 7ff7e93c037c 16053->16215 16056 7ff7e93c0250 16054->16056 16059 7ff7e93c001b 16055->16059 16060 7ff7e93bffcf 16055->16060 16075 7ff7e93c000f 16055->16075 16058 7ff7e93b9c58 __free_lconv_mon 11 API calls 16056->16058 16058->16049 16065 7ff7e93bdea8 _get_daylight 11 API calls 16059->16065 16072 7ff7e93bffde 16059->16072 16082 7ff7e93c0043 16059->16082 16230 7ff7e93b8a14 16060->16230 16063 7ff7e93bdea8 _get_daylight 11 API calls 16068 7ff7e93c0065 16063->16068 16064 7ff7e93b9c58 __free_lconv_mon 11 API calls 16064->16049 16069 7ff7e93c0035 16065->16069 16067 7ff7e93c00eb 16073 7ff7e93b9c58 __free_lconv_mon 11 API calls 16067->16073 16074 7ff7e93b9c58 __free_lconv_mon 11 API calls 16068->16074 16077 7ff7e93b9c58 __free_lconv_mon 11 API calls 16069->16077 16070 7ff7e93bffd9 16078 7ff7e93b43f4 _get_daylight 11 API calls 16070->16078 16071 7ff7e93bfff7 16071->16075 16081 7ff7e93c037c 45 API calls 16071->16081 16072->16064 16080 7ff7e93c00f4 16073->16080 16074->16075 16075->16072 16076 7ff7e93c00ce 16075->16076 16236 7ff7e93c62fc 16075->16236 16076->16067 16079 7ff7e93c013e 16076->16079 16077->16082 16078->16072 16079->16072 16083 7ff7e93c26ec 40 API calls 16079->16083 16086 7ff7e93c26ec 40 API calls 16080->16086 16089 7ff7e93c00fa 16080->16089 16081->16075 16082->16063 16082->16072 16082->16075 16084 7ff7e93c017c 16083->16084 16085 7ff7e93b9c58 __free_lconv_mon 11 API calls 16084->16085 16087 7ff7e93c0186 16085->16087 16090 7ff7e93c0126 16086->16090 16087->16072 16087->16089 16088 7ff7e93c023f 16091 7ff7e93b9c58 __free_lconv_mon 11 API calls 16088->16091 16089->16088 16093 7ff7e93bdea8 _get_daylight 11 API calls 16089->16093 16092 7ff7e93b9c58 __free_lconv_mon 11 API calls 16090->16092 16091->16049 16092->16089 16094 7ff7e93c01cb 16093->16094 16095 7ff7e93c01d3 16094->16095 16096 7ff7e93c01dc 16094->16096 16097 7ff7e93b9c58 __free_lconv_mon 11 API calls 16095->16097 16121 7ff7e93bf784 16096->16121 16099 7ff7e93c01da 16097->16099 16106 7ff7e93b9c58 __free_lconv_mon 11 API calls 16099->16106 16101 7ff7e93c01f2 SetEnvironmentVariableW 16103 7ff7e93c0216 16101->16103 16104 7ff7e93c0237 16101->16104 16102 7ff7e93c027f 16105 7ff7e93b9c10 _isindst 17 API calls 16102->16105 16107 7ff7e93b43f4 _get_daylight 11 API calls 16103->16107 16109 7ff7e93b9c58 __free_lconv_mon 11 API calls 16104->16109 16108 7ff7e93c0293 16105->16108 16106->16049 16110 7ff7e93c021b 16107->16110 16109->16088 16111 7ff7e93b9c58 __free_lconv_mon 11 API calls 16110->16111 16111->16099 16113 7ff7e93b97c1 16112->16113 16114 7ff7e93b97cb 16112->16114 16113->16114 16119 7ff7e93b97e6 16113->16119 16115 7ff7e93b43f4 _get_daylight 11 API calls 16114->16115 16116 7ff7e93b97d2 16115->16116 16117 7ff7e93b9bf0 _invalid_parameter_noinfo 37 API calls 16116->16117 16118 7ff7e93b97de 16117->16118 16118->16035 16118->16036 16119->16118 16120 7ff7e93b43f4 _get_daylight 11 API calls 16119->16120 16120->16116 16122 7ff7e93bf791 16121->16122 16123 7ff7e93bf79b 16121->16123 16122->16123 16127 7ff7e93bf7b7 16122->16127 16124 7ff7e93b43f4 _get_daylight 11 API calls 16123->16124 16129 7ff7e93bf7a3 16124->16129 16125 7ff7e93b9bf0 _invalid_parameter_noinfo 37 API calls 16126 7ff7e93bf7af 16125->16126 16126->16101 16126->16102 16127->16126 16128 7ff7e93b43f4 _get_daylight 11 API calls 16127->16128 16128->16129 16129->16125 16131 7ff7e93c02b1 16130->16131 16132 7ff7e93c02c9 16130->16132 16131->15988 16133 7ff7e93bdea8 _get_daylight 11 API calls 16132->16133 16139 7ff7e93c02ed 16133->16139 16134 7ff7e93c034e 16137 7ff7e93b9c58 __free_lconv_mon 11 API calls 16134->16137 16135 7ff7e93b9814 _CreateFrameInfo 45 API calls 16136 7ff7e93c0378 16135->16136 16137->16131 16138 7ff7e93bdea8 _get_daylight 11 API calls 16138->16139 16139->16134 16139->16138 16140 7ff7e93b9c58 __free_lconv_mon 11 API calls 16139->16140 16141 7ff7e93b97b4 __std_exception_copy 37 API calls 16139->16141 16142 7ff7e93c035d 16139->16142 16144 7ff7e93c0372 16139->16144 16140->16139 16141->16139 16143 7ff7e93b9c10 _isindst 17 API calls 16142->16143 16143->16144 16144->16135 16146 7ff7e93b89e8 16145->16146 16150 7ff7e93b89f1 16145->16150 16146->16150 16260 7ff7e93b84b0 16146->16260 16150->16005 16150->16006 16152 7ff7e93c5564 16151->16152 16153 7ff7e93c6449 16151->16153 16154 7ff7e93c5571 16152->16154 16161 7ff7e93c55a7 16152->16161 16155 7ff7e93b4178 45 API calls 16153->16155 16158 7ff7e93b43f4 _get_daylight 11 API calls 16154->16158 16159 7ff7e93c5518 16154->16159 16157 7ff7e93c647d 16155->16157 16156 7ff7e93c55d1 16160 7ff7e93b43f4 _get_daylight 11 API calls 16156->16160 16164 7ff7e93c6493 16157->16164 16167 7ff7e93c64aa 16157->16167 16183 7ff7e93c6482 16157->16183 16162 7ff7e93c557b 16158->16162 16159->15999 16163 7ff7e93c55d6 16160->16163 16161->16156 16169 7ff7e93c55f6 16161->16169 16165 7ff7e93b9bf0 _invalid_parameter_noinfo 37 API calls 16162->16165 16166 7ff7e93b9bf0 _invalid_parameter_noinfo 37 API calls 16163->16166 16168 7ff7e93b43f4 _get_daylight 11 API calls 16164->16168 16170 7ff7e93c5586 16165->16170 16175 7ff7e93c55e1 16166->16175 16171 7ff7e93c64c6 16167->16171 16172 7ff7e93c64b4 16167->16172 16173 7ff7e93c6498 16168->16173 16174 7ff7e93b4178 45 API calls 16169->16174 16169->16175 16170->15999 16177 7ff7e93c64d7 16171->16177 16178 7ff7e93c64ee 16171->16178 16176 7ff7e93b43f4 _get_daylight 11 API calls 16172->16176 16179 7ff7e93b9bf0 _invalid_parameter_noinfo 37 API calls 16173->16179 16174->16175 16175->15999 16180 7ff7e93c64b9 16176->16180 16546 7ff7e93c55b4 16177->16546 16555 7ff7e93c825c 16178->16555 16179->16183 16184 7ff7e93b9bf0 _invalid_parameter_noinfo 37 API calls 16180->16184 16183->15999 16184->16183 16186 7ff7e93b43f4 _get_daylight 11 API calls 16186->16183 16188 7ff7e93c270e 16187->16188 16189 7ff7e93c272b 16187->16189 16188->16189 16190 7ff7e93c271c 16188->16190 16191 7ff7e93c2735 16189->16191 16595 7ff7e93c6f48 16189->16595 16193 7ff7e93b43f4 _get_daylight 11 API calls 16190->16193 16602 7ff7e93c6f84 16191->16602 16195 7ff7e93c2721 __scrt_get_show_window_mode 16193->16195 16195->16024 16197 7ff7e93b4178 45 API calls 16196->16197 16198 7ff7e93c65ba 16197->16198 16199 7ff7e93c65c8 16198->16199 16614 7ff7e93be234 16198->16614 16617 7ff7e93b47bc 16199->16617 16203 7ff7e93c66b4 16206 7ff7e93c66c5 16203->16206 16207 7ff7e93b9c58 __free_lconv_mon 11 API calls 16203->16207 16204 7ff7e93b4178 45 API calls 16205 7ff7e93c6637 16204->16205 16210 7ff7e93be234 5 API calls 16205->16210 16212 7ff7e93c6640 16205->16212 16208 7ff7e93bfeb3 16206->16208 16209 7ff7e93b9c58 __free_lconv_mon 11 API calls 16206->16209 16207->16206 16208->16042 16208->16043 16209->16208 16210->16212 16211 7ff7e93b47bc 14 API calls 16213 7ff7e93c669b 16211->16213 16212->16211 16213->16203 16214 7ff7e93c66a3 SetEnvironmentVariableW 16213->16214 16214->16203 16216 7ff7e93c03bc 16215->16216 16222 7ff7e93c039f 16215->16222 16217 7ff7e93bdea8 _get_daylight 11 API calls 16216->16217 16225 7ff7e93c03e0 16217->16225 16218 7ff7e93c0441 16220 7ff7e93b9c58 __free_lconv_mon 11 API calls 16218->16220 16219 7ff7e93b9814 _CreateFrameInfo 45 API calls 16221 7ff7e93c046a 16219->16221 16220->16222 16222->16055 16223 7ff7e93bdea8 _get_daylight 11 API calls 16223->16225 16224 7ff7e93b9c58 __free_lconv_mon 11 API calls 16224->16225 16225->16218 16225->16223 16225->16224 16226 7ff7e93bf784 37 API calls 16225->16226 16227 7ff7e93c0450 16225->16227 16229 7ff7e93c0464 16225->16229 16226->16225 16228 7ff7e93b9c10 _isindst 17 API calls 16227->16228 16228->16229 16229->16219 16231 7ff7e93b8a2d 16230->16231 16232 7ff7e93b8a24 16230->16232 16231->16070 16231->16071 16232->16231 16644 7ff7e93b8524 16232->16644 16237 7ff7e93c6309 16236->16237 16240 7ff7e93c6336 16236->16240 16238 7ff7e93c630e 16237->16238 16237->16240 16239 7ff7e93b43f4 _get_daylight 11 API calls 16238->16239 16242 7ff7e93c6313 16239->16242 16241 7ff7e93c637a 16240->16241 16244 7ff7e93c6399 16240->16244 16258 7ff7e93c636e __crtLCMapStringW 16240->16258 16243 7ff7e93b43f4 _get_daylight 11 API calls 16241->16243 16245 7ff7e93b9bf0 _invalid_parameter_noinfo 37 API calls 16242->16245 16246 7ff7e93c637f 16243->16246 16247 7ff7e93c63b5 16244->16247 16248 7ff7e93c63a3 16244->16248 16249 7ff7e93c631e 16245->16249 16251 7ff7e93b9bf0 _invalid_parameter_noinfo 37 API calls 16246->16251 16250 7ff7e93b4178 45 API calls 16247->16250 16252 7ff7e93b43f4 _get_daylight 11 API calls 16248->16252 16249->16075 16253 7ff7e93c63c2 16250->16253 16251->16258 16254 7ff7e93c63a8 16252->16254 16253->16258 16691 7ff7e93c7e18 16253->16691 16255 7ff7e93b9bf0 _invalid_parameter_noinfo 37 API calls 16254->16255 16255->16258 16258->16075 16259 7ff7e93b43f4 _get_daylight 11 API calls 16259->16258 16261 7ff7e93b84c5 16260->16261 16262 7ff7e93b84c9 16260->16262 16261->16150 16275 7ff7e93b8804 16261->16275 16283 7ff7e93c1900 16262->16283 16267 7ff7e93b84e7 16309 7ff7e93b8594 16267->16309 16268 7ff7e93b84db 16269 7ff7e93b9c58 __free_lconv_mon 11 API calls 16268->16269 16269->16261 16272 7ff7e93b9c58 __free_lconv_mon 11 API calls 16273 7ff7e93b850e 16272->16273 16274 7ff7e93b9c58 __free_lconv_mon 11 API calls 16273->16274 16274->16261 16276 7ff7e93b882d 16275->16276 16281 7ff7e93b8846 16275->16281 16276->16150 16277 7ff7e93bfaf8 WideCharToMultiByte 16277->16281 16278 7ff7e93bdea8 _get_daylight 11 API calls 16278->16281 16279 7ff7e93b88d6 16280 7ff7e93b9c58 __free_lconv_mon 11 API calls 16279->16280 16280->16276 16281->16276 16281->16277 16281->16278 16281->16279 16282 7ff7e93b9c58 __free_lconv_mon 11 API calls 16281->16282 16282->16281 16284 7ff7e93b84ce 16283->16284 16285 7ff7e93c190d 16283->16285 16289 7ff7e93c1c3c GetEnvironmentStringsW 16284->16289 16328 7ff7e93ba534 16285->16328 16290 7ff7e93b84d3 16289->16290 16291 7ff7e93c1c6c 16289->16291 16290->16267 16290->16268 16292 7ff7e93bfaf8 WideCharToMultiByte 16291->16292 16293 7ff7e93c1cbd 16292->16293 16294 7ff7e93c1cc4 FreeEnvironmentStringsW 16293->16294 16295 7ff7e93bc90c _fread_nolock 12 API calls 16293->16295 16294->16290 16296 7ff7e93c1cd7 16295->16296 16297 7ff7e93c1cdf 16296->16297 16298 7ff7e93c1ce8 16296->16298 16299 7ff7e93b9c58 __free_lconv_mon 11 API calls 16297->16299 16300 7ff7e93bfaf8 WideCharToMultiByte 16298->16300 16301 7ff7e93c1ce6 16299->16301 16302 7ff7e93c1d0b 16300->16302 16301->16294 16303 7ff7e93c1d0f 16302->16303 16304 7ff7e93c1d19 16302->16304 16305 7ff7e93b9c58 __free_lconv_mon 11 API calls 16303->16305 16306 7ff7e93b9c58 __free_lconv_mon 11 API calls 16304->16306 16307 7ff7e93c1d17 FreeEnvironmentStringsW 16305->16307 16306->16307 16307->16290 16310 7ff7e93b85b9 16309->16310 16311 7ff7e93bdea8 _get_daylight 11 API calls 16310->16311 16323 7ff7e93b85ef 16311->16323 16312 7ff7e93b9c58 __free_lconv_mon 11 API calls 16314 7ff7e93b84ef 16312->16314 16313 7ff7e93b866a 16315 7ff7e93b9c58 __free_lconv_mon 11 API calls 16313->16315 16314->16272 16315->16314 16316 7ff7e93bdea8 _get_daylight 11 API calls 16316->16323 16317 7ff7e93b8659 16540 7ff7e93b87c0 16317->16540 16319 7ff7e93b97b4 __std_exception_copy 37 API calls 16319->16323 16321 7ff7e93b9c58 __free_lconv_mon 11 API calls 16324 7ff7e93b85f7 16321->16324 16322 7ff7e93b868f 16325 7ff7e93b9c10 _isindst 17 API calls 16322->16325 16323->16313 16323->16316 16323->16317 16323->16319 16323->16322 16323->16324 16326 7ff7e93b9c58 __free_lconv_mon 11 API calls 16323->16326 16324->16312 16327 7ff7e93b86a2 16325->16327 16326->16323 16329 7ff7e93ba560 FlsSetValue 16328->16329 16330 7ff7e93ba545 FlsGetValue 16328->16330 16331 7ff7e93ba552 16329->16331 16333 7ff7e93ba56d 16329->16333 16330->16331 16332 7ff7e93ba55a 16330->16332 16334 7ff7e93ba558 16331->16334 16335 7ff7e93b9814 _CreateFrameInfo 45 API calls 16331->16335 16332->16329 16336 7ff7e93bdea8 _get_daylight 11 API calls 16333->16336 16348 7ff7e93c15d4 16334->16348 16337 7ff7e93ba5d5 16335->16337 16338 7ff7e93ba57c 16336->16338 16339 7ff7e93ba59a FlsSetValue 16338->16339 16340 7ff7e93ba58a FlsSetValue 16338->16340 16341 7ff7e93ba5a6 FlsSetValue 16339->16341 16342 7ff7e93ba5b8 16339->16342 16343 7ff7e93ba593 16340->16343 16341->16343 16345 7ff7e93ba204 _get_daylight 11 API calls 16342->16345 16344 7ff7e93b9c58 __free_lconv_mon 11 API calls 16343->16344 16344->16331 16346 7ff7e93ba5c0 16345->16346 16347 7ff7e93b9c58 __free_lconv_mon 11 API calls 16346->16347 16347->16334 16371 7ff7e93c1844 16348->16371 16350 7ff7e93c1609 16386 7ff7e93c12d4 16350->16386 16353 7ff7e93bc90c _fread_nolock 12 API calls 16354 7ff7e93c1637 16353->16354 16355 7ff7e93c163f 16354->16355 16357 7ff7e93c164e 16354->16357 16356 7ff7e93b9c58 __free_lconv_mon 11 API calls 16355->16356 16369 7ff7e93c1626 16356->16369 16357->16357 16393 7ff7e93c197c 16357->16393 16360 7ff7e93c1764 16365 7ff7e93c17a5 16360->16365 16370 7ff7e93b9c58 __free_lconv_mon 11 API calls 16360->16370 16361 7ff7e93c174a 16362 7ff7e93b43f4 _get_daylight 11 API calls 16361->16362 16363 7ff7e93c174f 16362->16363 16366 7ff7e93b9c58 __free_lconv_mon 11 API calls 16363->16366 16364 7ff7e93c180c 16368 7ff7e93b9c58 __free_lconv_mon 11 API calls 16364->16368 16365->16364 16404 7ff7e93c1104 16365->16404 16366->16369 16368->16369 16369->16284 16370->16365 16372 7ff7e93c1867 16371->16372 16373 7ff7e93c1871 16372->16373 16419 7ff7e93bf5e8 EnterCriticalSection 16372->16419 16377 7ff7e93c18e3 16373->16377 16378 7ff7e93b9814 _CreateFrameInfo 45 API calls 16373->16378 16377->16350 16380 7ff7e93c18fb 16378->16380 16381 7ff7e93c1952 16380->16381 16383 7ff7e93ba534 50 API calls 16380->16383 16381->16350 16384 7ff7e93c193c 16383->16384 16385 7ff7e93c15d4 65 API calls 16384->16385 16385->16381 16420 7ff7e93b4178 16386->16420 16389 7ff7e93c1306 16391 7ff7e93c130b GetACP 16389->16391 16392 7ff7e93c131b 16389->16392 16390 7ff7e93c12f4 GetOEMCP 16390->16392 16391->16392 16392->16353 16392->16369 16394 7ff7e93c12d4 47 API calls 16393->16394 16395 7ff7e93c19a9 16394->16395 16396 7ff7e93c1aff 16395->16396 16397 7ff7e93c19e6 IsValidCodePage 16395->16397 16403 7ff7e93c1a00 __scrt_get_show_window_mode 16395->16403 16398 7ff7e93ab870 _log10_special 8 API calls 16396->16398 16397->16396 16399 7ff7e93c19f7 16397->16399 16400 7ff7e93c1741 16398->16400 16401 7ff7e93c1a26 GetCPInfo 16399->16401 16399->16403 16400->16360 16400->16361 16401->16396 16401->16403 16452 7ff7e93c13ec 16403->16452 16539 7ff7e93bf5e8 EnterCriticalSection 16404->16539 16421 7ff7e93b4197 16420->16421 16422 7ff7e93b419c 16420->16422 16421->16389 16421->16390 16422->16421 16423 7ff7e93ba460 _CreateFrameInfo 45 API calls 16422->16423 16424 7ff7e93b41b7 16423->16424 16428 7ff7e93bcc94 16424->16428 16429 7ff7e93b41da 16428->16429 16430 7ff7e93bcca9 16428->16430 16432 7ff7e93bcd00 16429->16432 16430->16429 16436 7ff7e93c2614 16430->16436 16433 7ff7e93bcd15 16432->16433 16435 7ff7e93bcd28 16432->16435 16433->16435 16449 7ff7e93c1960 16433->16449 16435->16421 16437 7ff7e93ba460 _CreateFrameInfo 45 API calls 16436->16437 16438 7ff7e93c2623 16437->16438 16439 7ff7e93c266e 16438->16439 16448 7ff7e93bf5e8 EnterCriticalSection 16438->16448 16439->16429 16450 7ff7e93ba460 _CreateFrameInfo 45 API calls 16449->16450 16451 7ff7e93c1969 16450->16451 16453 7ff7e93c1429 GetCPInfo 16452->16453 16462 7ff7e93c151f 16452->16462 16458 7ff7e93c143c 16453->16458 16453->16462 16454 7ff7e93ab870 _log10_special 8 API calls 16455 7ff7e93c15be 16454->16455 16455->16396 16463 7ff7e93c2150 16458->16463 16462->16454 16464 7ff7e93b4178 45 API calls 16463->16464 16465 7ff7e93c2192 16464->16465 16483 7ff7e93bebb0 16465->16483 16485 7ff7e93bebb9 MultiByteToWideChar 16483->16485 16541 7ff7e93b87c5 16540->16541 16545 7ff7e93b8661 16540->16545 16542 7ff7e93b87ee 16541->16542 16543 7ff7e93b9c58 __free_lconv_mon 11 API calls 16541->16543 16544 7ff7e93b9c58 __free_lconv_mon 11 API calls 16542->16544 16543->16541 16544->16545 16545->16321 16547 7ff7e93c55d1 16546->16547 16548 7ff7e93c55e8 16546->16548 16549 7ff7e93b43f4 _get_daylight 11 API calls 16547->16549 16548->16547 16551 7ff7e93c55f6 16548->16551 16550 7ff7e93c55d6 16549->16550 16552 7ff7e93b9bf0 _invalid_parameter_noinfo 37 API calls 16550->16552 16553 7ff7e93b4178 45 API calls 16551->16553 16554 7ff7e93c55e1 16551->16554 16552->16554 16553->16554 16554->16183 16556 7ff7e93b4178 45 API calls 16555->16556 16557 7ff7e93c8281 16556->16557 16560 7ff7e93c7ed8 16557->16560 16563 7ff7e93c7f26 16560->16563 16561 7ff7e93ab870 _log10_special 8 API calls 16562 7ff7e93c6515 16561->16562 16562->16183 16562->16186 16564 7ff7e93c7fad 16563->16564 16566 7ff7e93c7f98 GetCPInfo 16563->16566 16569 7ff7e93c7fb1 16563->16569 16565 7ff7e93bebb0 _fread_nolock MultiByteToWideChar 16564->16565 16564->16569 16567 7ff7e93c8045 16565->16567 16566->16564 16566->16569 16568 7ff7e93bc90c _fread_nolock 12 API calls 16567->16568 16567->16569 16570 7ff7e93c807c 16567->16570 16568->16570 16569->16561 16570->16569 16571 7ff7e93bebb0 _fread_nolock MultiByteToWideChar 16570->16571 16572 7ff7e93c80ea 16571->16572 16573 7ff7e93c81cc 16572->16573 16574 7ff7e93bebb0 _fread_nolock MultiByteToWideChar 16572->16574 16573->16569 16575 7ff7e93b9c58 __free_lconv_mon 11 API calls 16573->16575 16576 7ff7e93c8110 16574->16576 16575->16569 16576->16573 16577 7ff7e93bc90c _fread_nolock 12 API calls 16576->16577 16578 7ff7e93c813d 16576->16578 16577->16578 16578->16573 16579 7ff7e93bebb0 _fread_nolock MultiByteToWideChar 16578->16579 16580 7ff7e93c81b4 16579->16580 16581 7ff7e93c81d4 16580->16581 16582 7ff7e93c81ba 16580->16582 16589 7ff7e93be278 16581->16589 16582->16573 16584 7ff7e93b9c58 __free_lconv_mon 11 API calls 16582->16584 16584->16573 16586 7ff7e93c8213 16586->16569 16588 7ff7e93b9c58 __free_lconv_mon 11 API calls 16586->16588 16587 7ff7e93b9c58 __free_lconv_mon 11 API calls 16587->16586 16588->16569 16590 7ff7e93be020 __crtLCMapStringW 5 API calls 16589->16590 16591 7ff7e93be2b6 16590->16591 16592 7ff7e93be4e0 __crtLCMapStringW 5 API calls 16591->16592 16593 7ff7e93be2be 16591->16593 16594 7ff7e93be327 CompareStringW 16592->16594 16593->16586 16593->16587 16594->16593 16596 7ff7e93c6f51 16595->16596 16597 7ff7e93c6f6a HeapSize 16595->16597 16598 7ff7e93b43f4 _get_daylight 11 API calls 16596->16598 16599 7ff7e93c6f56 16598->16599 16600 7ff7e93b9bf0 _invalid_parameter_noinfo 37 API calls 16599->16600 16601 7ff7e93c6f61 16600->16601 16601->16191 16603 7ff7e93c6fa3 16602->16603 16604 7ff7e93c6f99 16602->16604 16605 7ff7e93c6fa8 16603->16605 16612 7ff7e93c6faf _get_daylight 16603->16612 16606 7ff7e93bc90c _fread_nolock 12 API calls 16604->16606 16607 7ff7e93b9c58 __free_lconv_mon 11 API calls 16605->16607 16610 7ff7e93c6fa1 16606->16610 16607->16610 16608 7ff7e93c6fe2 HeapReAlloc 16608->16610 16608->16612 16609 7ff7e93c6fb5 16611 7ff7e93b43f4 _get_daylight 11 API calls 16609->16611 16610->16195 16611->16610 16612->16608 16612->16609 16613 7ff7e93c28a0 _get_daylight 2 API calls 16612->16613 16613->16612 16615 7ff7e93be020 __crtLCMapStringW 5 API calls 16614->16615 16616 7ff7e93be254 16615->16616 16616->16199 16618 7ff7e93b47e6 16617->16618 16619 7ff7e93b480a 16617->16619 16623 7ff7e93b9c58 __free_lconv_mon 11 API calls 16618->16623 16624 7ff7e93b47f5 16618->16624 16620 7ff7e93b480f 16619->16620 16621 7ff7e93b4864 16619->16621 16620->16624 16627 7ff7e93b9c58 __free_lconv_mon 11 API calls 16620->16627 16631 7ff7e93b4824 16620->16631 16622 7ff7e93bebb0 _fread_nolock MultiByteToWideChar 16621->16622 16629 7ff7e93b4880 16622->16629 16623->16624 16624->16203 16624->16204 16625 7ff7e93bc90c _fread_nolock 12 API calls 16625->16624 16626 7ff7e93b4887 GetLastError 16639 7ff7e93b4368 16626->16639 16627->16631 16629->16626 16630 7ff7e93b48c2 16629->16630 16634 7ff7e93b48b5 16629->16634 16638 7ff7e93b9c58 __free_lconv_mon 11 API calls 16629->16638 16630->16624 16632 7ff7e93bebb0 _fread_nolock MultiByteToWideChar 16630->16632 16631->16625 16636 7ff7e93b4906 16632->16636 16635 7ff7e93bc90c _fread_nolock 12 API calls 16634->16635 16635->16630 16636->16624 16636->16626 16637 7ff7e93b43f4 _get_daylight 11 API calls 16637->16624 16638->16634 16640 7ff7e93ba5d8 _get_daylight 11 API calls 16639->16640 16641 7ff7e93b4375 __free_lconv_mon 16640->16641 16642 7ff7e93ba5d8 _get_daylight 11 API calls 16641->16642 16643 7ff7e93b4397 16642->16643 16643->16637 16645 7ff7e93b853d 16644->16645 16646 7ff7e93b8539 16644->16646 16665 7ff7e93c1d4c GetEnvironmentStringsW 16645->16665 16646->16231 16657 7ff7e93b88e4 16646->16657 16649 7ff7e93b8556 16672 7ff7e93b86a4 16649->16672 16650 7ff7e93b854a 16651 7ff7e93b9c58 __free_lconv_mon 11 API calls 16650->16651 16651->16646 16654 7ff7e93b9c58 __free_lconv_mon 11 API calls 16655 7ff7e93b857d 16654->16655 16656 7ff7e93b9c58 __free_lconv_mon 11 API calls 16655->16656 16656->16646 16658 7ff7e93b8907 16657->16658 16662 7ff7e93b891e 16657->16662 16658->16231 16659 7ff7e93bebb0 MultiByteToWideChar _fread_nolock 16659->16662 16660 7ff7e93bdea8 _get_daylight 11 API calls 16660->16662 16661 7ff7e93b8992 16663 7ff7e93b9c58 __free_lconv_mon 11 API calls 16661->16663 16662->16658 16662->16659 16662->16660 16662->16661 16664 7ff7e93b9c58 __free_lconv_mon 11 API calls 16662->16664 16663->16658 16664->16662 16666 7ff7e93b8542 16665->16666 16669 7ff7e93c1d70 16665->16669 16666->16649 16666->16650 16667 7ff7e93bc90c _fread_nolock 12 API calls 16668 7ff7e93c1da7 memcpy_s 16667->16668 16670 7ff7e93b9c58 __free_lconv_mon 11 API calls 16668->16670 16669->16667 16671 7ff7e93c1dc7 FreeEnvironmentStringsW 16670->16671 16671->16666 16673 7ff7e93b86cc 16672->16673 16674 7ff7e93bdea8 _get_daylight 11 API calls 16673->16674 16685 7ff7e93b8707 16674->16685 16675 7ff7e93b870f 16676 7ff7e93b9c58 __free_lconv_mon 11 API calls 16675->16676 16677 7ff7e93b855e 16676->16677 16677->16654 16678 7ff7e93b8789 16679 7ff7e93b9c58 __free_lconv_mon 11 API calls 16678->16679 16679->16677 16680 7ff7e93bdea8 _get_daylight 11 API calls 16680->16685 16681 7ff7e93b8778 16682 7ff7e93b87c0 11 API calls 16681->16682 16684 7ff7e93b8780 16682->16684 16683 7ff7e93bf784 37 API calls 16683->16685 16687 7ff7e93b9c58 __free_lconv_mon 11 API calls 16684->16687 16685->16675 16685->16678 16685->16680 16685->16681 16685->16683 16686 7ff7e93b87ac 16685->16686 16688 7ff7e93b9c58 __free_lconv_mon 11 API calls 16685->16688 16689 7ff7e93b9c10 _isindst 17 API calls 16686->16689 16687->16675 16688->16685 16690 7ff7e93b87be 16689->16690 16692 7ff7e93c7e41 __crtLCMapStringW 16691->16692 16693 7ff7e93c63fe 16692->16693 16694 7ff7e93be278 6 API calls 16692->16694 16693->16258 16693->16259 16694->16693 16960 7ff7e93abf5c 16983 7ff7e93ac12c 16960->16983 16963 7ff7e93ac0a8 17110 7ff7e93ac44c IsProcessorFeaturePresent 16963->17110 16964 7ff7e93abf78 __scrt_acquire_startup_lock 16966 7ff7e93ac0b2 16964->16966 16968 7ff7e93abf96 16964->16968 16967 7ff7e93ac44c 7 API calls 16966->16967 16970 7ff7e93ac0bd _CreateFrameInfo 16967->16970 16969 7ff7e93abfbb 16968->16969 16975 7ff7e93abfd8 __scrt_release_startup_lock 16968->16975 17095 7ff7e93b8af0 16968->17095 16972 7ff7e93ac041 16989 7ff7e93ac594 16972->16989 16974 7ff7e93ac046 16992 7ff7e93a1000 16974->16992 16975->16972 17099 7ff7e93b8e44 16975->17099 16981 7ff7e93ac069 16981->16970 17106 7ff7e93ac2b0 16981->17106 16984 7ff7e93ac134 16983->16984 16985 7ff7e93ac140 __scrt_dllmain_crt_thread_attach 16984->16985 16986 7ff7e93abf70 16985->16986 16987 7ff7e93ac14d 16985->16987 16986->16963 16986->16964 16987->16986 17117 7ff7e93acba8 16987->17117 16990 7ff7e93c97e0 __scrt_get_show_window_mode 16989->16990 16991 7ff7e93ac5ab GetStartupInfoW 16990->16991 16991->16974 16993 7ff7e93a1009 16992->16993 17144 7ff7e93b4794 16993->17144 16995 7ff7e93a352b 17151 7ff7e93a33e0 16995->17151 16999 7ff7e93ab870 _log10_special 8 API calls 17003 7ff7e93a372a 16999->17003 17001 7ff7e93a3736 17342 7ff7e93a3f70 17001->17342 17002 7ff7e93a356c 17004 7ff7e93a1bf0 49 API calls 17002->17004 17104 7ff7e93ac5d8 GetModuleHandleW 17003->17104 17020 7ff7e93a3588 17004->17020 17007 7ff7e93a3785 17009 7ff7e93a25f0 53 API calls 17007->17009 17086 7ff7e93a3538 17009->17086 17011 7ff7e93a3778 17013 7ff7e93a379f 17011->17013 17014 7ff7e93a377d 17011->17014 17012 7ff7e93a365f __std_exception_destroy 17018 7ff7e93a7e10 14 API calls 17012->17018 17047 7ff7e93a3834 17012->17047 17016 7ff7e93a1bf0 49 API calls 17013->17016 17361 7ff7e93af36c 17014->17361 17017 7ff7e93a37be 17016->17017 17028 7ff7e93a18f0 115 API calls 17017->17028 17021 7ff7e93a36ae 17018->17021 17213 7ff7e93a7e10 17020->17213 17226 7ff7e93a7f80 17021->17226 17022 7ff7e93a3852 17023 7ff7e93a3871 17022->17023 17024 7ff7e93a3865 17022->17024 17027 7ff7e93a1bf0 49 API calls 17023->17027 17368 7ff7e93a3fe0 17024->17368 17031 7ff7e93a3805 __std_exception_destroy 17027->17031 17032 7ff7e93a37df 17028->17032 17029 7ff7e93a36bd 17030 7ff7e93a380f 17029->17030 17033 7ff7e93a36cf 17029->17033 17235 7ff7e93a8400 17030->17235 17286 7ff7e93a86b0 17031->17286 17032->17020 17036 7ff7e93a37ef 17032->17036 17231 7ff7e93a1bf0 17033->17231 17040 7ff7e93a25f0 53 API calls 17036->17040 17039 7ff7e93a389e SetDllDirectoryW 17045 7ff7e93a38c3 17039->17045 17040->17086 17043 7ff7e93a36fc 17331 7ff7e93a25f0 17043->17331 17048 7ff7e93a3a50 17045->17048 17291 7ff7e93a6560 17045->17291 17047->17031 17365 7ff7e93a3e90 17047->17365 17050 7ff7e93a3a5a PostMessageW GetMessageW 17048->17050 17051 7ff7e93a3a7d 17048->17051 17050->17051 17426 7ff7e93a3080 17051->17426 17054 7ff7e93a38ea 17055 7ff7e93a3947 17054->17055 17057 7ff7e93a3901 17054->17057 17371 7ff7e93a65a0 17054->17371 17055->17048 17062 7ff7e93a395c 17055->17062 17070 7ff7e93a3905 17057->17070 17392 7ff7e93a6970 17057->17392 17311 7ff7e93a30e0 17062->17311 17065 7ff7e93a6780 FreeLibrary 17067 7ff7e93a3aa3 17065->17067 17070->17055 17408 7ff7e93a2870 17070->17408 17086->16999 17096 7ff7e93b8b26 17095->17096 17097 7ff7e93b8af5 17095->17097 17096->16975 17097->17096 19295 7ff7e93b4720 17097->19295 17100 7ff7e93b8e7c 17099->17100 17101 7ff7e93b8e5b 17099->17101 17102 7ff7e93b96e8 45 API calls 17100->17102 17101->16972 17103 7ff7e93b8e81 17102->17103 17105 7ff7e93ac5e9 17104->17105 17105->16981 17108 7ff7e93ac2c1 17106->17108 17107 7ff7e93ac080 17107->16969 17108->17107 17109 7ff7e93acba8 7 API calls 17108->17109 17109->17107 17111 7ff7e93ac472 _isindst __scrt_get_show_window_mode 17110->17111 17112 7ff7e93ac491 RtlCaptureContext RtlLookupFunctionEntry 17111->17112 17113 7ff7e93ac4f6 __scrt_get_show_window_mode 17112->17113 17114 7ff7e93ac4ba RtlVirtualUnwind 17112->17114 17115 7ff7e93ac528 IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter 17113->17115 17114->17113 17116 7ff7e93ac576 _isindst 17115->17116 17116->16966 17118 7ff7e93acbb0 17117->17118 17119 7ff7e93acbba 17117->17119 17123 7ff7e93acf44 17118->17123 17119->16986 17124 7ff7e93acbb5 17123->17124 17125 7ff7e93acf53 17123->17125 17127 7ff7e93acfb0 17124->17127 17131 7ff7e93ad180 17125->17131 17128 7ff7e93acfdb 17127->17128 17129 7ff7e93acfdf 17128->17129 17130 7ff7e93acfbe DeleteCriticalSection 17128->17130 17129->17119 17130->17128 17135 7ff7e93acfe8 17131->17135 17136 7ff7e93ad0d2 TlsFree 17135->17136 17141 7ff7e93ad02c __vcrt_FlsAlloc 17135->17141 17137 7ff7e93ad05a LoadLibraryExW 17139 7ff7e93ad0f9 17137->17139 17140 7ff7e93ad07b GetLastError 17137->17140 17138 7ff7e93ad119 GetProcAddress 17138->17136 17139->17138 17142 7ff7e93ad110 FreeLibrary 17139->17142 17140->17141 17141->17136 17141->17137 17141->17138 17143 7ff7e93ad09d LoadLibraryExW 17141->17143 17142->17138 17143->17139 17143->17141 17147 7ff7e93be790 17144->17147 17145 7ff7e93be7e3 17146 7ff7e93b9b24 _invalid_parameter_noinfo 37 API calls 17145->17146 17150 7ff7e93be80c 17146->17150 17147->17145 17148 7ff7e93be836 17147->17148 17439 7ff7e93be668 17148->17439 17150->16995 17447 7ff7e93abb70 17151->17447 17154 7ff7e93a3438 17449 7ff7e93a85a0 FindFirstFileExW 17154->17449 17155 7ff7e93a341b 17454 7ff7e93a29e0 17155->17454 17158 7ff7e93a342e 17163 7ff7e93ab870 _log10_special 8 API calls 17158->17163 17160 7ff7e93a34a5 17473 7ff7e93a8760 17160->17473 17161 7ff7e93a344b 17464 7ff7e93a8620 CreateFileW 17161->17464 17166 7ff7e93a34dd 17163->17166 17165 7ff7e93a34b3 17165->17158 17170 7ff7e93a26c0 49 API calls 17165->17170 17166->17086 17173 7ff7e93a18f0 17166->17173 17168 7ff7e93a3474 __vcrt_FlsAlloc 17168->17160 17169 7ff7e93a345c 17467 7ff7e93a26c0 17169->17467 17170->17158 17174 7ff7e93a3f70 108 API calls 17173->17174 17175 7ff7e93a1925 17174->17175 17177 7ff7e93a76a0 83 API calls 17175->17177 17182 7ff7e93a1bb6 17175->17182 17176 7ff7e93ab870 _log10_special 8 API calls 17178 7ff7e93a1bd1 17176->17178 17179 7ff7e93a196b 17177->17179 17178->17001 17178->17002 17212 7ff7e93a199c 17179->17212 17818 7ff7e93af9f4 17179->17818 17181 7ff7e93af36c 74 API calls 17181->17182 17182->17176 17183 7ff7e93a1985 17184 7ff7e93a19a1 17183->17184 17185 7ff7e93a1989 17183->17185 17822 7ff7e93af6bc 17184->17822 17825 7ff7e93a2760 17185->17825 17189 7ff7e93a19bf 17191 7ff7e93a2760 53 API calls 17189->17191 17190 7ff7e93a19d7 17192 7ff7e93a1a06 17190->17192 17193 7ff7e93a19ee 17190->17193 17191->17212 17195 7ff7e93a1bf0 49 API calls 17192->17195 17194 7ff7e93a2760 53 API calls 17193->17194 17194->17212 17196 7ff7e93a1a1d 17195->17196 17197 7ff7e93a1bf0 49 API calls 17196->17197 17198 7ff7e93a1a68 17197->17198 17199 7ff7e93af9f4 73 API calls 17198->17199 17200 7ff7e93a1a8c 17199->17200 17201 7ff7e93a1aa1 17200->17201 17202 7ff7e93a1ab9 17200->17202 17203 7ff7e93a2760 53 API calls 17201->17203 17204 7ff7e93af6bc _fread_nolock 53 API calls 17202->17204 17203->17212 17205 7ff7e93a1ace 17204->17205 17206 7ff7e93a1ad4 17205->17206 17207 7ff7e93a1aec 17205->17207 17208 7ff7e93a2760 53 API calls 17206->17208 17842 7ff7e93af430 17207->17842 17208->17212 17211 7ff7e93a25f0 53 API calls 17211->17212 17212->17181 17214 7ff7e93a7e1a 17213->17214 17215 7ff7e93a86b0 2 API calls 17214->17215 17216 7ff7e93a7e39 GetEnvironmentVariableW 17215->17216 17217 7ff7e93a7ea2 17216->17217 17218 7ff7e93a7e56 ExpandEnvironmentStringsW 17216->17218 17219 7ff7e93ab870 _log10_special 8 API calls 17217->17219 17218->17217 17220 7ff7e93a7e78 17218->17220 17221 7ff7e93a7eb4 17219->17221 17222 7ff7e93a8760 2 API calls 17220->17222 17221->17012 17223 7ff7e93a7e8a 17222->17223 17224 7ff7e93ab870 _log10_special 8 API calls 17223->17224 17225 7ff7e93a7e9a 17224->17225 17225->17012 17227 7ff7e93a86b0 2 API calls 17226->17227 17228 7ff7e93a7f94 17227->17228 18048 7ff7e93b7548 17228->18048 17230 7ff7e93a7fa6 __std_exception_destroy 17230->17029 17232 7ff7e93a1c15 17231->17232 17233 7ff7e93b3ca4 49 API calls 17232->17233 17234 7ff7e93a1c38 17233->17234 17234->17031 17234->17043 17236 7ff7e93a8415 17235->17236 18066 7ff7e93a7b50 GetCurrentProcess OpenProcessToken 17236->18066 17239 7ff7e93a7b50 7 API calls 17240 7ff7e93a8441 17239->17240 17241 7ff7e93a8474 17240->17241 17242 7ff7e93a845a 17240->17242 17244 7ff7e93a2590 48 API calls 17241->17244 17243 7ff7e93a2590 48 API calls 17242->17243 17245 7ff7e93a8472 17243->17245 17246 7ff7e93a8487 LocalFree LocalFree 17244->17246 17245->17246 17247 7ff7e93a84a3 17246->17247 17249 7ff7e93a84af 17246->17249 18076 7ff7e93a2940 17247->18076 17250 7ff7e93ab870 _log10_special 8 API calls 17249->17250 17287 7ff7e93a86d2 MultiByteToWideChar 17286->17287 17288 7ff7e93a86f6 17286->17288 17287->17288 17290 7ff7e93a870c __std_exception_destroy 17287->17290 17289 7ff7e93a8713 MultiByteToWideChar 17288->17289 17288->17290 17289->17290 17290->17039 17292 7ff7e93a6575 17291->17292 17293 7ff7e93a38d5 17292->17293 17294 7ff7e93a2760 53 API calls 17292->17294 17295 7ff7e93a6b00 17293->17295 17294->17293 17296 7ff7e93a6b30 17295->17296 17309 7ff7e93a6b4a __std_exception_destroy 17295->17309 17296->17309 18251 7ff7e93a1440 17296->18251 17298 7ff7e93a6b54 17299 7ff7e93a3fe0 49 API calls 17298->17299 17298->17309 17300 7ff7e93a6b76 17299->17300 17301 7ff7e93a6b7b 17300->17301 17302 7ff7e93a3fe0 49 API calls 17300->17302 17303 7ff7e93a2870 53 API calls 17301->17303 17304 7ff7e93a6b9a 17302->17304 17303->17309 17304->17301 17305 7ff7e93a3fe0 49 API calls 17304->17305 17306 7ff7e93a6bb6 17305->17306 17306->17301 17307 7ff7e93a6bbf 17306->17307 17308 7ff7e93a25f0 53 API calls 17307->17308 17310 7ff7e93a6c2f __std_exception_destroy memcpy_s 17307->17310 17308->17309 17309->17054 17310->17054 17312 7ff7e93a30ee __scrt_get_show_window_mode 17311->17312 17314 7ff7e93a32e7 17312->17314 17317 7ff7e93a1bf0 49 API calls 17312->17317 17318 7ff7e93a3309 17312->17318 17323 7ff7e93a32e9 17312->17323 17325 7ff7e93a2870 53 API calls 17312->17325 17328 7ff7e93a32f7 17312->17328 18312 7ff7e93a3f10 17312->18312 18318 7ff7e93a7530 17312->18318 18329 7ff7e93a15c0 17312->18329 18367 7ff7e93a68e0 17312->18367 18371 7ff7e93a3b40 17312->18371 18415 7ff7e93a3e00 17312->18415 17313 7ff7e93ab870 _log10_special 8 API calls 17315 7ff7e93a338e 17313->17315 17314->17313 17315->17086 17330 7ff7e93a83e0 LocalFree 17315->17330 17317->17312 17320 7ff7e93a25f0 53 API calls 17318->17320 17320->17314 17324 7ff7e93a25f0 53 API calls 17323->17324 17324->17314 17325->17312 17329 7ff7e93a25f0 53 API calls 17328->17329 17329->17314 17332 7ff7e93a262a 17331->17332 17333 7ff7e93b3ca4 49 API calls 17332->17333 17334 7ff7e93a2652 17333->17334 17335 7ff7e93a86b0 2 API calls 17334->17335 17336 7ff7e93a266a 17335->17336 17337 7ff7e93a2677 MessageBoxW 17336->17337 17338 7ff7e93a268e MessageBoxA 17336->17338 17343 7ff7e93a3f7c 17342->17343 17344 7ff7e93a86b0 2 API calls 17343->17344 17345 7ff7e93a3fa4 17344->17345 17346 7ff7e93a86b0 2 API calls 17345->17346 17347 7ff7e93a3fb7 17346->17347 18535 7ff7e93b52a4 17347->18535 17350 7ff7e93ab870 _log10_special 8 API calls 17351 7ff7e93a3746 17350->17351 17351->17007 17352 7ff7e93a76a0 17351->17352 17353 7ff7e93a76c4 17352->17353 17354 7ff7e93a779b __std_exception_destroy 17353->17354 17355 7ff7e93af9f4 73 API calls 17353->17355 17354->17011 17356 7ff7e93a76e0 17355->17356 17356->17354 18926 7ff7e93b6bd8 17356->18926 17358 7ff7e93af9f4 73 API calls 17360 7ff7e93a76f5 17358->17360 17359 7ff7e93af6bc _fread_nolock 53 API calls 17359->17360 17360->17354 17360->17358 17360->17359 17362 7ff7e93af39c 17361->17362 18941 7ff7e93af148 17362->18941 17364 7ff7e93af3b5 17364->17007 17366 7ff7e93a1bf0 49 API calls 17365->17366 17367 7ff7e93a3ead 17366->17367 17367->17022 17369 7ff7e93a1bf0 49 API calls 17368->17369 17370 7ff7e93a4010 17369->17370 17370->17031 17372 7ff7e93a65bc 17371->17372 17375 7ff7e93a17e0 45 API calls 17372->17375 17376 7ff7e93a675d 17372->17376 17378 7ff7e93a1bf0 49 API calls 17372->17378 17379 7ff7e93a66df 17372->17379 17380 7ff7e93a674a 17372->17380 17381 7ff7e93a3f10 10 API calls 17372->17381 17383 7ff7e93a670d 17372->17383 17384 7ff7e93a7530 52 API calls 17372->17384 17386 7ff7e93a2870 53 API calls 17372->17386 17387 7ff7e93a6737 17372->17387 17389 7ff7e93a15c0 118 API calls 17372->17389 17390 7ff7e93a6720 17372->17390 17373 7ff7e93ab870 _log10_special 8 API calls 17374 7ff7e93a66f1 17373->17374 17374->17057 17375->17372 17377 7ff7e93a25f0 53 API calls 17376->17377 17377->17379 17378->17372 17379->17373 17382 7ff7e93a25f0 53 API calls 17380->17382 17381->17372 17382->17379 17385 7ff7e93a25f0 53 API calls 17383->17385 17384->17372 17385->17379 17386->17372 17388 7ff7e93a25f0 53 API calls 17387->17388 17388->17379 17389->17372 17391 7ff7e93a25f0 53 API calls 17390->17391 17391->17379 18952 7ff7e93a81a0 17392->18952 17394 7ff7e93a6989 17395 7ff7e93a81a0 3 API calls 17394->17395 17396 7ff7e93a699c 17395->17396 17397 7ff7e93a69cf 17396->17397 17398 7ff7e93a69b4 17396->17398 17399 7ff7e93a25f0 53 API calls 17397->17399 18956 7ff7e93a6ea0 GetProcAddress 17398->18956 17401 7ff7e93a3916 17399->17401 17401->17070 17402 7ff7e93a6cd0 17401->17402 17409 7ff7e93a28aa 17408->17409 17410 7ff7e93b3ca4 49 API calls 17409->17410 17411 7ff7e93a28d2 17410->17411 17412 7ff7e93a86b0 2 API calls 17411->17412 17413 7ff7e93a28ea 17412->17413 17414 7ff7e93a28f7 MessageBoxW 17413->17414 17415 7ff7e93a290e MessageBoxA 17413->17415 17416 7ff7e93a2920 17414->17416 17415->17416 17417 7ff7e93ab870 _log10_special 8 API calls 17416->17417 17418 7ff7e93a2930 17417->17418 17419 7ff7e93a6780 17418->17419 17420 7ff7e93a68d6 17419->17420 17425 7ff7e93a6792 17419->17425 17420->17055 19021 7ff7e93a5af0 17426->19021 17434 7ff7e93a30b9 17435 7ff7e93a33a0 17434->17435 17436 7ff7e93a33ae 17435->17436 17437 7ff7e93a33bf 17436->17437 19294 7ff7e93a8180 FreeLibrary 17436->19294 17437->17065 17446 7ff7e93b477c EnterCriticalSection 17439->17446 17448 7ff7e93a33ec GetModuleFileNameW 17447->17448 17448->17154 17448->17155 17450 7ff7e93a85f2 17449->17450 17451 7ff7e93a85df FindClose 17449->17451 17452 7ff7e93ab870 _log10_special 8 API calls 17450->17452 17451->17450 17453 7ff7e93a3442 17452->17453 17453->17160 17453->17161 17455 7ff7e93abb70 17454->17455 17456 7ff7e93a29fc GetLastError 17455->17456 17457 7ff7e93a2a29 17456->17457 17478 7ff7e93b3ef8 17457->17478 17462 7ff7e93ab870 _log10_special 8 API calls 17463 7ff7e93a2ae5 17462->17463 17463->17158 17465 7ff7e93a8660 GetFinalPathNameByHandleW CloseHandle 17464->17465 17466 7ff7e93a3458 17464->17466 17465->17466 17466->17168 17466->17169 17468 7ff7e93a26fa 17467->17468 17469 7ff7e93b3ef8 48 API calls 17468->17469 17470 7ff7e93a2722 MessageBoxW 17469->17470 17471 7ff7e93ab870 _log10_special 8 API calls 17470->17471 17472 7ff7e93a274c 17471->17472 17472->17158 17474 7ff7e93a878a WideCharToMultiByte 17473->17474 17476 7ff7e93a87b5 17473->17476 17474->17476 17477 7ff7e93a87cb __std_exception_destroy 17474->17477 17475 7ff7e93a87d2 WideCharToMultiByte 17475->17477 17476->17475 17476->17477 17477->17165 17479 7ff7e93b3f52 17478->17479 17480 7ff7e93b3f77 17479->17480 17482 7ff7e93b3fb3 17479->17482 17481 7ff7e93b9b24 _invalid_parameter_noinfo 37 API calls 17480->17481 17484 7ff7e93b3fa1 17481->17484 17500 7ff7e93b22b0 17482->17500 17486 7ff7e93ab870 _log10_special 8 API calls 17484->17486 17485 7ff7e93b4094 17487 7ff7e93b9c58 __free_lconv_mon 11 API calls 17485->17487 17489 7ff7e93a2a54 FormatMessageW 17486->17489 17487->17484 17496 7ff7e93a2590 17489->17496 17490 7ff7e93b4069 17493 7ff7e93b9c58 __free_lconv_mon 11 API calls 17490->17493 17491 7ff7e93b40ba 17491->17485 17492 7ff7e93b40c4 17491->17492 17495 7ff7e93b9c58 __free_lconv_mon 11 API calls 17492->17495 17493->17484 17494 7ff7e93b4060 17494->17485 17494->17490 17495->17484 17497 7ff7e93a25b5 17496->17497 17498 7ff7e93b3ef8 48 API calls 17497->17498 17499 7ff7e93a25d8 MessageBoxW 17498->17499 17499->17462 17501 7ff7e93b22ee 17500->17501 17502 7ff7e93b22de 17500->17502 17503 7ff7e93b22f7 17501->17503 17508 7ff7e93b2325 17501->17508 17504 7ff7e93b9b24 _invalid_parameter_noinfo 37 API calls 17502->17504 17505 7ff7e93b9b24 _invalid_parameter_noinfo 37 API calls 17503->17505 17506 7ff7e93b231d 17504->17506 17505->17506 17506->17485 17506->17490 17506->17491 17506->17494 17508->17502 17508->17506 17511 7ff7e93b2cc4 17508->17511 17544 7ff7e93b2710 17508->17544 17581 7ff7e93b1ea0 17508->17581 17512 7ff7e93b2d06 17511->17512 17513 7ff7e93b2d77 17511->17513 17514 7ff7e93b2da1 17512->17514 17515 7ff7e93b2d0c 17512->17515 17516 7ff7e93b2dd0 17513->17516 17517 7ff7e93b2d7c 17513->17517 17604 7ff7e93b1074 17514->17604 17518 7ff7e93b2d11 17515->17518 17519 7ff7e93b2d40 17515->17519 17522 7ff7e93b2dda 17516->17522 17523 7ff7e93b2de7 17516->17523 17528 7ff7e93b2ddf 17516->17528 17520 7ff7e93b2db1 17517->17520 17521 7ff7e93b2d7e 17517->17521 17518->17523 17525 7ff7e93b2d17 17518->17525 17519->17525 17519->17528 17611 7ff7e93b0c64 17520->17611 17526 7ff7e93b2d20 17521->17526 17531 7ff7e93b2d8d 17521->17531 17522->17514 17522->17528 17618 7ff7e93b39cc 17523->17618 17525->17526 17532 7ff7e93b2d52 17525->17532 17541 7ff7e93b2d3b 17525->17541 17543 7ff7e93b2e10 17526->17543 17584 7ff7e93b3478 17526->17584 17528->17543 17622 7ff7e93b1484 17528->17622 17531->17514 17534 7ff7e93b2d92 17531->17534 17532->17543 17594 7ff7e93b37b4 17532->17594 17534->17543 17600 7ff7e93b3878 17534->17600 17536 7ff7e93ab870 _log10_special 8 API calls 17538 7ff7e93b310a 17536->17538 17538->17508 17542 7ff7e93b2ffc 17541->17542 17541->17543 17629 7ff7e93b3ae0 17541->17629 17542->17543 17635 7ff7e93bdd18 17542->17635 17543->17536 17545 7ff7e93b2734 17544->17545 17546 7ff7e93b271e 17544->17546 17547 7ff7e93b9b24 _invalid_parameter_noinfo 37 API calls 17545->17547 17550 7ff7e93b2774 17545->17550 17548 7ff7e93b2d06 17546->17548 17549 7ff7e93b2d77 17546->17549 17546->17550 17547->17550 17551 7ff7e93b2da1 17548->17551 17552 7ff7e93b2d0c 17548->17552 17553 7ff7e93b2dd0 17549->17553 17554 7ff7e93b2d7c 17549->17554 17550->17508 17561 7ff7e93b1074 38 API calls 17551->17561 17555 7ff7e93b2d11 17552->17555 17556 7ff7e93b2d40 17552->17556 17559 7ff7e93b2dda 17553->17559 17560 7ff7e93b2de7 17553->17560 17565 7ff7e93b2ddf 17553->17565 17557 7ff7e93b2db1 17554->17557 17558 7ff7e93b2d7e 17554->17558 17555->17560 17562 7ff7e93b2d17 17555->17562 17556->17562 17556->17565 17567 7ff7e93b0c64 38 API calls 17557->17567 17563 7ff7e93b2d20 17558->17563 17570 7ff7e93b2d8d 17558->17570 17559->17551 17559->17565 17566 7ff7e93b39cc 45 API calls 17560->17566 17576 7ff7e93b2d3b 17561->17576 17562->17563 17568 7ff7e93b2d52 17562->17568 17562->17576 17564 7ff7e93b3478 47 API calls 17563->17564 17580 7ff7e93b2e10 17563->17580 17564->17576 17569 7ff7e93b1484 38 API calls 17565->17569 17565->17580 17566->17576 17567->17576 17571 7ff7e93b37b4 46 API calls 17568->17571 17568->17580 17569->17576 17570->17551 17572 7ff7e93b2d92 17570->17572 17571->17576 17574 7ff7e93b3878 37 API calls 17572->17574 17572->17580 17573 7ff7e93ab870 _log10_special 8 API calls 17575 7ff7e93b310a 17573->17575 17574->17576 17575->17508 17577 7ff7e93b2ffc 17576->17577 17578 7ff7e93b3ae0 45 API calls 17576->17578 17576->17580 17579 7ff7e93bdd18 46 API calls 17577->17579 17577->17580 17578->17577 17579->17577 17580->17573 17801 7ff7e93b02e8 17581->17801 17585 7ff7e93b349e 17584->17585 17647 7ff7e93afea0 17585->17647 17590 7ff7e93b3ae0 45 API calls 17591 7ff7e93b35e3 17590->17591 17591->17591 17592 7ff7e93b3ae0 45 API calls 17591->17592 17593 7ff7e93b3671 17591->17593 17592->17593 17593->17541 17595 7ff7e93b37e9 17594->17595 17596 7ff7e93b382e 17595->17596 17597 7ff7e93b3807 17595->17597 17598 7ff7e93b3ae0 45 API calls 17595->17598 17596->17541 17599 7ff7e93bdd18 46 API calls 17597->17599 17598->17597 17599->17596 17603 7ff7e93b3899 17600->17603 17601 7ff7e93b9b24 _invalid_parameter_noinfo 37 API calls 17602 7ff7e93b38ca 17601->17602 17602->17541 17603->17601 17603->17602 17605 7ff7e93b10a7 17604->17605 17606 7ff7e93b10d6 17605->17606 17608 7ff7e93b1193 17605->17608 17610 7ff7e93b1113 17606->17610 17774 7ff7e93aff48 17606->17774 17609 7ff7e93b9b24 _invalid_parameter_noinfo 37 API calls 17608->17609 17609->17610 17610->17541 17612 7ff7e93b0c97 17611->17612 17613 7ff7e93b0cc6 17612->17613 17615 7ff7e93b0d83 17612->17615 17614 7ff7e93aff48 12 API calls 17613->17614 17617 7ff7e93b0d03 17613->17617 17614->17617 17616 7ff7e93b9b24 _invalid_parameter_noinfo 37 API calls 17615->17616 17616->17617 17617->17541 17619 7ff7e93b3a0f 17618->17619 17621 7ff7e93b3a13 __crtLCMapStringW 17619->17621 17782 7ff7e93b3a68 17619->17782 17621->17541 17623 7ff7e93b14b7 17622->17623 17624 7ff7e93b14e6 17623->17624 17626 7ff7e93b15a3 17623->17626 17625 7ff7e93aff48 12 API calls 17624->17625 17628 7ff7e93b1523 17624->17628 17625->17628 17627 7ff7e93b9b24 _invalid_parameter_noinfo 37 API calls 17626->17627 17627->17628 17628->17541 17630 7ff7e93b3af7 17629->17630 17786 7ff7e93bccc8 17630->17786 17636 7ff7e93bdd49 17635->17636 17642 7ff7e93bdd57 17635->17642 17637 7ff7e93bdd77 17636->17637 17638 7ff7e93b3ae0 45 API calls 17636->17638 17636->17642 17639 7ff7e93bddaf 17637->17639 17640 7ff7e93bdd88 17637->17640 17638->17637 17639->17642 17643 7ff7e93bde3a 17639->17643 17644 7ff7e93bddd9 17639->17644 17794 7ff7e93bf3b0 17640->17794 17642->17542 17645 7ff7e93bebb0 _fread_nolock MultiByteToWideChar 17643->17645 17644->17642 17646 7ff7e93bebb0 _fread_nolock MultiByteToWideChar 17644->17646 17645->17642 17646->17642 17648 7ff7e93afec6 17647->17648 17649 7ff7e93afed7 17647->17649 17655 7ff7e93bd880 17648->17655 17649->17648 17650 7ff7e93bc90c _fread_nolock 12 API calls 17649->17650 17651 7ff7e93aff04 17650->17651 17652 7ff7e93aff18 17651->17652 17653 7ff7e93b9c58 __free_lconv_mon 11 API calls 17651->17653 17654 7ff7e93b9c58 __free_lconv_mon 11 API calls 17652->17654 17653->17652 17654->17648 17656 7ff7e93bd8d0 17655->17656 17657 7ff7e93bd89d 17655->17657 17656->17657 17660 7ff7e93bd902 17656->17660 17658 7ff7e93b9b24 _invalid_parameter_noinfo 37 API calls 17657->17658 17659 7ff7e93b35c1 17658->17659 17659->17590 17659->17591 17665 7ff7e93bda15 17660->17665 17670 7ff7e93bd94a 17660->17670 17661 7ff7e93bdb07 17701 7ff7e93bcd6c 17661->17701 17663 7ff7e93bdacd 17694 7ff7e93bd104 17663->17694 17665->17661 17665->17663 17666 7ff7e93bda9c 17665->17666 17668 7ff7e93bda5f 17665->17668 17669 7ff7e93bda55 17665->17669 17687 7ff7e93bd3e4 17666->17687 17677 7ff7e93bd614 17668->17677 17669->17663 17672 7ff7e93bda5a 17669->17672 17670->17659 17673 7ff7e93b97b4 __std_exception_copy 37 API calls 17670->17673 17672->17666 17672->17668 17674 7ff7e93bda02 17673->17674 17674->17659 17675 7ff7e93b9c10 _isindst 17 API calls 17674->17675 17676 7ff7e93bdb64 17675->17676 17710 7ff7e93c33bc 17677->17710 17681 7ff7e93bd6bc 17682 7ff7e93bd711 17681->17682 17684 7ff7e93bd6dc 17681->17684 17686 7ff7e93bd6c0 17681->17686 17763 7ff7e93bd200 17682->17763 17684->17684 17759 7ff7e93bd4bc 17684->17759 17686->17659 17688 7ff7e93c33bc 38 API calls 17687->17688 17689 7ff7e93bd42e 17688->17689 17690 7ff7e93c2e04 37 API calls 17689->17690 17691 7ff7e93bd47e 17690->17691 17692 7ff7e93bd482 17691->17692 17693 7ff7e93bd4bc 45 API calls 17691->17693 17692->17659 17693->17692 17695 7ff7e93c33bc 38 API calls 17694->17695 17696 7ff7e93bd14f 17695->17696 17697 7ff7e93c2e04 37 API calls 17696->17697 17698 7ff7e93bd1a7 17697->17698 17699 7ff7e93bd1ab 17698->17699 17700 7ff7e93bd200 45 API calls 17698->17700 17699->17659 17700->17699 17702 7ff7e93bcdb1 17701->17702 17703 7ff7e93bcde4 17701->17703 17704 7ff7e93b9b24 _invalid_parameter_noinfo 37 API calls 17702->17704 17705 7ff7e93bcdfc 17703->17705 17707 7ff7e93bce7d 17703->17707 17709 7ff7e93bcddd __scrt_get_show_window_mode 17704->17709 17706 7ff7e93bd104 46 API calls 17705->17706 17706->17709 17708 7ff7e93b3ae0 45 API calls 17707->17708 17707->17709 17708->17709 17709->17659 17711 7ff7e93c340f fegetenv 17710->17711 17712 7ff7e93c713c 37 API calls 17711->17712 17718 7ff7e93c3462 17712->17718 17713 7ff7e93c348f 17717 7ff7e93b97b4 __std_exception_copy 37 API calls 17713->17717 17714 7ff7e93c3552 17715 7ff7e93c713c 37 API calls 17714->17715 17716 7ff7e93c357c 17715->17716 17721 7ff7e93c713c 37 API calls 17716->17721 17722 7ff7e93c350d 17717->17722 17718->17714 17719 7ff7e93c347d 17718->17719 17720 7ff7e93c352c 17718->17720 17719->17713 17719->17714 17725 7ff7e93b97b4 __std_exception_copy 37 API calls 17720->17725 17723 7ff7e93c358d 17721->17723 17724 7ff7e93c4634 17722->17724 17729 7ff7e93c3515 17722->17729 17726 7ff7e93c7330 20 API calls 17723->17726 17727 7ff7e93b9c10 _isindst 17 API calls 17724->17727 17725->17722 17736 7ff7e93c35f6 __scrt_get_show_window_mode 17726->17736 17728 7ff7e93c4649 17727->17728 17730 7ff7e93ab870 _log10_special 8 API calls 17729->17730 17731 7ff7e93bd661 17730->17731 17755 7ff7e93c2e04 17731->17755 17732 7ff7e93c399f __scrt_get_show_window_mode 17733 7ff7e93c3cdf 17735 7ff7e93c2f20 37 API calls 17733->17735 17734 7ff7e93c3637 memcpy_s 17734->17734 17748 7ff7e93c3a93 memcpy_s __scrt_get_show_window_mode 17734->17748 17749 7ff7e93c3f7b memcpy_s __scrt_get_show_window_mode 17734->17749 17741 7ff7e93c43f7 17735->17741 17736->17732 17736->17734 17739 7ff7e93b43f4 _get_daylight 11 API calls 17736->17739 17737 7ff7e93c3c8b 17737->17733 17738 7ff7e93c464c memcpy_s 37 API calls 17737->17738 17738->17733 17740 7ff7e93c3a70 17739->17740 17742 7ff7e93b9bf0 _invalid_parameter_noinfo 37 API calls 17740->17742 17744 7ff7e93c464c memcpy_s 37 API calls 17741->17744 17754 7ff7e93c4452 17741->17754 17742->17734 17743 7ff7e93c45d8 17745 7ff7e93c713c 37 API calls 17743->17745 17744->17754 17745->17729 17746 7ff7e93b43f4 11 API calls _get_daylight 17746->17749 17747 7ff7e93b43f4 11 API calls _get_daylight 17747->17748 17748->17737 17748->17747 17752 7ff7e93b9bf0 37 API calls _invalid_parameter_noinfo 17748->17752 17749->17733 17749->17737 17749->17746 17751 7ff7e93b9bf0 37 API calls _invalid_parameter_noinfo 17749->17751 17750 7ff7e93c2f20 37 API calls 17750->17754 17751->17749 17752->17748 17753 7ff7e93c464c memcpy_s 37 API calls 17753->17754 17754->17743 17754->17750 17754->17753 17757 7ff7e93c2e23 17755->17757 17756 7ff7e93b9b24 _invalid_parameter_noinfo 37 API calls 17758 7ff7e93c2e4e memcpy_s 17756->17758 17757->17756 17757->17758 17758->17681 17760 7ff7e93bd4e8 memcpy_s 17759->17760 17761 7ff7e93b3ae0 45 API calls 17760->17761 17762 7ff7e93bd5a2 memcpy_s __scrt_get_show_window_mode 17760->17762 17761->17762 17762->17686 17764 7ff7e93bd23b 17763->17764 17768 7ff7e93bd288 memcpy_s 17763->17768 17765 7ff7e93b9b24 _invalid_parameter_noinfo 37 API calls 17764->17765 17766 7ff7e93bd267 17765->17766 17766->17686 17767 7ff7e93bd2f3 17769 7ff7e93b97b4 __std_exception_copy 37 API calls 17767->17769 17768->17767 17770 7ff7e93b3ae0 45 API calls 17768->17770 17773 7ff7e93bd335 memcpy_s 17769->17773 17770->17767 17771 7ff7e93b9c10 _isindst 17 API calls 17772 7ff7e93bd3e0 17771->17772 17773->17771 17775 7ff7e93aff6e 17774->17775 17776 7ff7e93aff7f 17774->17776 17775->17610 17776->17775 17777 7ff7e93bc90c _fread_nolock 12 API calls 17776->17777 17778 7ff7e93affb0 17777->17778 17779 7ff7e93affc4 17778->17779 17780 7ff7e93b9c58 __free_lconv_mon 11 API calls 17778->17780 17781 7ff7e93b9c58 __free_lconv_mon 11 API calls 17779->17781 17780->17779 17781->17775 17783 7ff7e93b3a86 17782->17783 17784 7ff7e93b3a8e 17782->17784 17785 7ff7e93b3ae0 45 API calls 17783->17785 17784->17621 17785->17784 17787 7ff7e93bcce1 17786->17787 17789 7ff7e93b3b1f 17786->17789 17788 7ff7e93c2614 45 API calls 17787->17788 17787->17789 17788->17789 17790 7ff7e93bcd34 17789->17790 17791 7ff7e93b3b2f 17790->17791 17792 7ff7e93bcd4d 17790->17792 17791->17542 17792->17791 17793 7ff7e93c1960 45 API calls 17792->17793 17793->17791 17797 7ff7e93c6098 17794->17797 17800 7ff7e93c60fc 17797->17800 17798 7ff7e93ab870 _log10_special 8 API calls 17799 7ff7e93bf3cd 17798->17799 17799->17642 17800->17798 17802 7ff7e93b032f 17801->17802 17803 7ff7e93b031d 17801->17803 17806 7ff7e93b033d 17802->17806 17810 7ff7e93b0379 17802->17810 17804 7ff7e93b43f4 _get_daylight 11 API calls 17803->17804 17805 7ff7e93b0322 17804->17805 17807 7ff7e93b9bf0 _invalid_parameter_noinfo 37 API calls 17805->17807 17808 7ff7e93b9b24 _invalid_parameter_noinfo 37 API calls 17806->17808 17815 7ff7e93b032d 17807->17815 17808->17815 17809 7ff7e93b06f5 17811 7ff7e93b43f4 _get_daylight 11 API calls 17809->17811 17809->17815 17810->17809 17812 7ff7e93b43f4 _get_daylight 11 API calls 17810->17812 17813 7ff7e93b0989 17811->17813 17814 7ff7e93b06ea 17812->17814 17816 7ff7e93b9bf0 _invalid_parameter_noinfo 37 API calls 17813->17816 17817 7ff7e93b9bf0 _invalid_parameter_noinfo 37 API calls 17814->17817 17815->17508 17816->17815 17817->17809 17819 7ff7e93afa24 17818->17819 17848 7ff7e93af784 17819->17848 17821 7ff7e93afa3d 17821->17183 17860 7ff7e93af6dc 17822->17860 17826 7ff7e93a277c 17825->17826 17827 7ff7e93b43f4 _get_daylight 11 API calls 17826->17827 17828 7ff7e93a2799 17827->17828 17874 7ff7e93b3ca4 17828->17874 17833 7ff7e93a1bf0 49 API calls 17834 7ff7e93a2807 17833->17834 17835 7ff7e93a86b0 2 API calls 17834->17835 17836 7ff7e93a281f 17835->17836 17837 7ff7e93a2843 MessageBoxA 17836->17837 17838 7ff7e93a282c MessageBoxW 17836->17838 17839 7ff7e93a2855 17837->17839 17838->17839 17840 7ff7e93ab870 _log10_special 8 API calls 17839->17840 17841 7ff7e93a2865 17840->17841 17841->17212 17843 7ff7e93af439 17842->17843 17844 7ff7e93a1b06 17842->17844 17845 7ff7e93b43f4 _get_daylight 11 API calls 17843->17845 17844->17211 17844->17212 17846 7ff7e93af43e 17845->17846 17847 7ff7e93b9bf0 _invalid_parameter_noinfo 37 API calls 17846->17847 17847->17844 17849 7ff7e93af7ee 17848->17849 17850 7ff7e93af7ae 17848->17850 17849->17850 17852 7ff7e93af7fa 17849->17852 17851 7ff7e93b9b24 _invalid_parameter_noinfo 37 API calls 17850->17851 17853 7ff7e93af7d5 17851->17853 17859 7ff7e93b477c EnterCriticalSection 17852->17859 17853->17821 17861 7ff7e93a19b9 17860->17861 17862 7ff7e93af706 17860->17862 17861->17189 17861->17190 17862->17861 17863 7ff7e93af752 17862->17863 17864 7ff7e93af715 __scrt_get_show_window_mode 17862->17864 17873 7ff7e93b477c EnterCriticalSection 17863->17873 17867 7ff7e93b43f4 _get_daylight 11 API calls 17864->17867 17869 7ff7e93af72a 17867->17869 17871 7ff7e93b9bf0 _invalid_parameter_noinfo 37 API calls 17869->17871 17871->17861 17878 7ff7e93b3cfe 17874->17878 17875 7ff7e93b3d23 17876 7ff7e93b9b24 _invalid_parameter_noinfo 37 API calls 17875->17876 17891 7ff7e93b3d4d 17876->17891 17877 7ff7e93b3d5f 17904 7ff7e93b1f30 17877->17904 17878->17875 17878->17877 17880 7ff7e93b3e3c 17882 7ff7e93b9c58 __free_lconv_mon 11 API calls 17880->17882 17881 7ff7e93ab870 _log10_special 8 API calls 17884 7ff7e93a27d8 17881->17884 17882->17891 17892 7ff7e93b4480 17884->17892 17885 7ff7e93b3e11 17887 7ff7e93b9c58 __free_lconv_mon 11 API calls 17885->17887 17886 7ff7e93b3e60 17886->17880 17889 7ff7e93b3e6a 17886->17889 17887->17891 17888 7ff7e93b3e08 17888->17880 17888->17885 17890 7ff7e93b9c58 __free_lconv_mon 11 API calls 17889->17890 17890->17891 17891->17881 17893 7ff7e93ba5d8 _get_daylight 11 API calls 17892->17893 17894 7ff7e93b4497 17893->17894 17895 7ff7e93a27df 17894->17895 17896 7ff7e93bdea8 _get_daylight 11 API calls 17894->17896 17899 7ff7e93b44d7 17894->17899 17895->17833 17897 7ff7e93b44cc 17896->17897 17898 7ff7e93b9c58 __free_lconv_mon 11 API calls 17897->17898 17898->17899 17899->17895 18039 7ff7e93bdf30 17899->18039 17902 7ff7e93b9c10 _isindst 17 API calls 17903 7ff7e93b451c 17902->17903 17905 7ff7e93b1f6e 17904->17905 17906 7ff7e93b1f5e 17904->17906 17907 7ff7e93b1f77 17905->17907 17911 7ff7e93b1fa5 17905->17911 17910 7ff7e93b9b24 _invalid_parameter_noinfo 37 API calls 17906->17910 17908 7ff7e93b9b24 _invalid_parameter_noinfo 37 API calls 17907->17908 17909 7ff7e93b1f9d 17908->17909 17909->17880 17909->17885 17909->17886 17909->17888 17910->17909 17911->17906 17911->17909 17912 7ff7e93b3ae0 45 API calls 17911->17912 17913 7ff7e93b2254 17911->17913 17918 7ff7e93b28c0 17911->17918 17944 7ff7e93b2588 17911->17944 17974 7ff7e93b1e10 17911->17974 17912->17911 17916 7ff7e93b9b24 _invalid_parameter_noinfo 37 API calls 17913->17916 17916->17906 17919 7ff7e93b2902 17918->17919 17920 7ff7e93b2975 17918->17920 17921 7ff7e93b299f 17919->17921 17922 7ff7e93b2908 17919->17922 17923 7ff7e93b297a 17920->17923 17928 7ff7e93b29cf 17920->17928 17991 7ff7e93b0e70 17921->17991 17929 7ff7e93b290d 17922->17929 17932 7ff7e93b29de 17922->17932 17925 7ff7e93b29af 17923->17925 17926 7ff7e93b297c 17923->17926 17998 7ff7e93b0a60 17925->17998 17927 7ff7e93b291d 17926->17927 17935 7ff7e93b298b 17926->17935 17943 7ff7e93b2a0d 17927->17943 17977 7ff7e93b3224 17927->17977 17928->17921 17928->17932 17942 7ff7e93b2938 17928->17942 17929->17927 17934 7ff7e93b2950 17929->17934 17929->17942 17932->17943 18005 7ff7e93b1280 17932->18005 17934->17943 17987 7ff7e93b36e0 17934->17987 17935->17921 17936 7ff7e93b2990 17935->17936 17939 7ff7e93b3878 37 API calls 17936->17939 17936->17943 17938 7ff7e93ab870 _log10_special 8 API calls 17940 7ff7e93b2ca3 17938->17940 17939->17942 17940->17911 17942->17943 18012 7ff7e93bdb68 17942->18012 17943->17938 17945 7ff7e93b2593 17944->17945 17946 7ff7e93b25a9 17944->17946 17948 7ff7e93b25e7 17945->17948 17949 7ff7e93b2902 17945->17949 17950 7ff7e93b2975 17945->17950 17947 7ff7e93b9b24 _invalid_parameter_noinfo 37 API calls 17946->17947 17946->17948 17947->17948 17948->17911 17951 7ff7e93b299f 17949->17951 17952 7ff7e93b2908 17949->17952 17953 7ff7e93b29cf 17950->17953 17954 7ff7e93b297a 17950->17954 17957 7ff7e93b0e70 38 API calls 17951->17957 17961 7ff7e93b290d 17952->17961 17965 7ff7e93b29de 17952->17965 17953->17951 17953->17965 17972 7ff7e93b2938 17953->17972 17955 7ff7e93b29af 17954->17955 17956 7ff7e93b297c 17954->17956 17959 7ff7e93b0a60 38 API calls 17955->17959 17958 7ff7e93b291d 17956->17958 17963 7ff7e93b298b 17956->17963 17957->17972 17960 7ff7e93b3224 47 API calls 17958->17960 17971 7ff7e93b2a0d 17958->17971 17959->17972 17960->17972 17961->17958 17964 7ff7e93b2950 17961->17964 17961->17972 17962 7ff7e93b1280 38 API calls 17962->17972 17963->17951 17966 7ff7e93b2990 17963->17966 17967 7ff7e93b36e0 47 API calls 17964->17967 17964->17971 17965->17962 17965->17971 17969 7ff7e93b3878 37 API calls 17966->17969 17966->17971 17967->17972 17968 7ff7e93ab870 _log10_special 8 API calls 17970 7ff7e93b2ca3 17968->17970 17969->17972 17970->17911 17971->17968 17972->17971 17973 7ff7e93bdb68 47 API calls 17972->17973 17973->17972 18022 7ff7e93b0034 17974->18022 17978 7ff7e93b3246 17977->17978 17979 7ff7e93afea0 12 API calls 17978->17979 17980 7ff7e93b328e 17979->17980 17981 7ff7e93bd880 46 API calls 17980->17981 17982 7ff7e93b3361 17981->17982 17983 7ff7e93b3ae0 45 API calls 17982->17983 17984 7ff7e93b3383 17982->17984 17983->17984 17984->17984 17985 7ff7e93b3ae0 45 API calls 17984->17985 17986 7ff7e93b340c 17984->17986 17985->17986 17986->17942 17988 7ff7e93b3760 17987->17988 17989 7ff7e93b36f8 17987->17989 17988->17942 17989->17988 17990 7ff7e93bdb68 47 API calls 17989->17990 17990->17988 17992 7ff7e93b0ea3 17991->17992 17993 7ff7e93b0ed2 17992->17993 17995 7ff7e93b0f8f 17992->17995 17994 7ff7e93afea0 12 API calls 17993->17994 17997 7ff7e93b0f0f 17993->17997 17994->17997 17996 7ff7e93b9b24 _invalid_parameter_noinfo 37 API calls 17995->17996 17996->17997 17997->17942 17999 7ff7e93b0a93 17998->17999 18000 7ff7e93b0ac2 17999->18000 18002 7ff7e93b0b7f 17999->18002 18001 7ff7e93afea0 12 API calls 18000->18001 18004 7ff7e93b0aff 18000->18004 18001->18004 18003 7ff7e93b9b24 _invalid_parameter_noinfo 37 API calls 18002->18003 18003->18004 18004->17942 18006 7ff7e93b12b3 18005->18006 18007 7ff7e93b12e2 18006->18007 18009 7ff7e93b139f 18006->18009 18008 7ff7e93afea0 12 API calls 18007->18008 18011 7ff7e93b131f 18007->18011 18008->18011 18010 7ff7e93b9b24 _invalid_parameter_noinfo 37 API calls 18009->18010 18010->18011 18011->17942 18013 7ff7e93bdb90 18012->18013 18014 7ff7e93bdbd5 18013->18014 18015 7ff7e93b3ae0 45 API calls 18013->18015 18017 7ff7e93bdb95 __scrt_get_show_window_mode 18013->18017 18021 7ff7e93bdbbe __scrt_get_show_window_mode 18013->18021 18014->18017 18018 7ff7e93bfaf8 WideCharToMultiByte 18014->18018 18014->18021 18015->18014 18016 7ff7e93b9b24 _invalid_parameter_noinfo 37 API calls 18016->18017 18017->17942 18019 7ff7e93bdcb1 18018->18019 18019->18017 18020 7ff7e93bdcc6 GetLastError 18019->18020 18020->18017 18020->18021 18021->18016 18021->18017 18023 7ff7e93b0061 18022->18023 18024 7ff7e93b0073 18022->18024 18025 7ff7e93b43f4 _get_daylight 11 API calls 18023->18025 18027 7ff7e93b0080 18024->18027 18030 7ff7e93b00bd 18024->18030 18026 7ff7e93b0066 18025->18026 18028 7ff7e93b9bf0 _invalid_parameter_noinfo 37 API calls 18026->18028 18029 7ff7e93b9b24 _invalid_parameter_noinfo 37 API calls 18027->18029 18036 7ff7e93b0071 18028->18036 18029->18036 18031 7ff7e93b0166 18030->18031 18032 7ff7e93b43f4 _get_daylight 11 API calls 18030->18032 18033 7ff7e93b43f4 _get_daylight 11 API calls 18031->18033 18031->18036 18034 7ff7e93b015b 18032->18034 18035 7ff7e93b0210 18033->18035 18037 7ff7e93b9bf0 _invalid_parameter_noinfo 37 API calls 18034->18037 18038 7ff7e93b9bf0 _invalid_parameter_noinfo 37 API calls 18035->18038 18036->17911 18037->18031 18038->18036 18042 7ff7e93bdf4d 18039->18042 18040 7ff7e93bdf52 18041 7ff7e93b43f4 _get_daylight 11 API calls 18040->18041 18045 7ff7e93b44fd 18040->18045 18047 7ff7e93bdf5c 18041->18047 18042->18040 18044 7ff7e93bdf9c 18042->18044 18042->18045 18043 7ff7e93b9bf0 _invalid_parameter_noinfo 37 API calls 18043->18045 18044->18045 18046 7ff7e93b43f4 _get_daylight 11 API calls 18044->18046 18045->17895 18045->17902 18046->18047 18047->18043 18049 7ff7e93b7555 18048->18049 18050 7ff7e93b7568 18048->18050 18052 7ff7e93b43f4 _get_daylight 11 API calls 18049->18052 18058 7ff7e93b71cc 18050->18058 18053 7ff7e93b755a 18052->18053 18056 7ff7e93b9bf0 _invalid_parameter_noinfo 37 API calls 18053->18056 18055 7ff7e93b7566 18055->17230 18056->18055 18065 7ff7e93bf5e8 EnterCriticalSection 18058->18065 18067 7ff7e93a7b91 GetTokenInformation 18066->18067 18068 7ff7e93a7c13 __std_exception_destroy 18066->18068 18069 7ff7e93a7bb2 GetLastError 18067->18069 18070 7ff7e93a7bbd 18067->18070 18071 7ff7e93a7c26 CloseHandle 18068->18071 18072 7ff7e93a7c2c 18068->18072 18069->18068 18069->18070 18070->18068 18073 7ff7e93a7bd9 GetTokenInformation 18070->18073 18071->18072 18072->17239 18073->18068 18074 7ff7e93a7bfc 18073->18074 18074->18068 18075 7ff7e93a7c06 ConvertSidToStringSidW 18074->18075 18075->18068 18077 7ff7e93a297a 18076->18077 18252 7ff7e93a3f70 108 API calls 18251->18252 18253 7ff7e93a1463 18252->18253 18254 7ff7e93a148c 18253->18254 18255 7ff7e93a146b 18253->18255 18256 7ff7e93af9f4 73 API calls 18254->18256 18257 7ff7e93a25f0 53 API calls 18255->18257 18259 7ff7e93a14a1 18256->18259 18258 7ff7e93a147b 18257->18258 18258->17298 18260 7ff7e93a14c1 18259->18260 18261 7ff7e93a14a5 18259->18261 18263 7ff7e93a14f1 18260->18263 18264 7ff7e93a14d1 18260->18264 18262 7ff7e93a2760 53 API calls 18261->18262 18270 7ff7e93a14bc __std_exception_destroy 18262->18270 18267 7ff7e93a14f7 18263->18267 18272 7ff7e93a150a 18263->18272 18265 7ff7e93a2760 53 API calls 18264->18265 18265->18270 18266 7ff7e93af36c 74 API calls 18268 7ff7e93a1584 18266->18268 18275 7ff7e93a11f0 18267->18275 18268->17298 18270->18266 18271 7ff7e93af6bc _fread_nolock 53 API calls 18271->18272 18272->18270 18272->18271 18273 7ff7e93a1596 18272->18273 18274 7ff7e93a2760 53 API calls 18273->18274 18274->18270 18276 7ff7e93a1248 18275->18276 18277 7ff7e93a124f 18276->18277 18278 7ff7e93a1277 18276->18278 18279 7ff7e93a25f0 53 API calls 18277->18279 18281 7ff7e93a1291 18278->18281 18282 7ff7e93a12ad 18278->18282 18280 7ff7e93a1262 18279->18280 18280->18270 18283 7ff7e93a2760 53 API calls 18281->18283 18284 7ff7e93a12bf 18282->18284 18291 7ff7e93a12db memcpy_s 18282->18291 18313 7ff7e93a3f1a 18312->18313 18314 7ff7e93a86b0 2 API calls 18313->18314 18315 7ff7e93a3f3f 18314->18315 18316 7ff7e93ab870 _log10_special 8 API calls 18315->18316 18317 7ff7e93a3f67 18316->18317 18317->17312 18319 7ff7e93a753e 18318->18319 18320 7ff7e93a7662 18319->18320 18321 7ff7e93a1bf0 49 API calls 18319->18321 18322 7ff7e93ab870 _log10_special 8 API calls 18320->18322 18326 7ff7e93a75c5 18321->18326 18323 7ff7e93a7693 18322->18323 18323->17312 18324 7ff7e93a1bf0 49 API calls 18324->18326 18325 7ff7e93a3f10 10 API calls 18325->18326 18326->18320 18326->18324 18326->18325 18327 7ff7e93a86b0 2 API calls 18326->18327 18328 7ff7e93a7633 CreateDirectoryW 18327->18328 18328->18320 18328->18326 18330 7ff7e93a15d3 18329->18330 18331 7ff7e93a15f7 18329->18331 18418 7ff7e93a1050 18330->18418 18333 7ff7e93a3f70 108 API calls 18331->18333 18335 7ff7e93a160b 18333->18335 18334 7ff7e93a15d8 18337 7ff7e93a1613 18335->18337 18338 7ff7e93a163b 18335->18338 18340 7ff7e93a2760 53 API calls 18337->18340 18341 7ff7e93a3f70 108 API calls 18338->18341 18343 7ff7e93a162a 18340->18343 18342 7ff7e93a164f 18341->18342 18344 7ff7e93a1671 18342->18344 18345 7ff7e93a1657 18342->18345 18343->17312 18347 7ff7e93af9f4 73 API calls 18344->18347 18346 7ff7e93a25f0 53 API calls 18345->18346 18368 7ff7e93a694b 18367->18368 18370 7ff7e93a6904 18367->18370 18368->17312 18370->18368 18457 7ff7e93b4250 18370->18457 18372 7ff7e93a3b51 18371->18372 18373 7ff7e93a3e90 49 API calls 18372->18373 18374 7ff7e93a3b8b 18373->18374 18375 7ff7e93a3e90 49 API calls 18374->18375 18376 7ff7e93a3b9b 18375->18376 18377 7ff7e93a3bec 18376->18377 18378 7ff7e93a3bbd 18376->18378 18379 7ff7e93a3ac0 51 API calls 18377->18379 18472 7ff7e93a3ac0 18378->18472 18381 7ff7e93a3bea 18379->18381 18382 7ff7e93a3c17 18381->18382 18383 7ff7e93a3c4c 18381->18383 18416 7ff7e93a1bf0 49 API calls 18415->18416 18417 7ff7e93a3e24 18416->18417 18417->17312 18419 7ff7e93a3f70 108 API calls 18418->18419 18420 7ff7e93a108b 18419->18420 18421 7ff7e93a1093 18420->18421 18422 7ff7e93a10a8 18420->18422 18423 7ff7e93a25f0 53 API calls 18421->18423 18424 7ff7e93af9f4 73 API calls 18422->18424 18429 7ff7e93a10a3 __std_exception_destroy 18423->18429 18425 7ff7e93a10bd 18424->18425 18426 7ff7e93a10c1 18425->18426 18427 7ff7e93a10dd 18425->18427 18429->18334 18458 7ff7e93b428a 18457->18458 18459 7ff7e93b425d 18457->18459 18460 7ff7e93b42ad 18458->18460 18463 7ff7e93b42c9 18458->18463 18461 7ff7e93b43f4 _get_daylight 11 API calls 18459->18461 18465 7ff7e93b4214 18459->18465 18462 7ff7e93b43f4 _get_daylight 11 API calls 18460->18462 18464 7ff7e93b4267 18461->18464 18466 7ff7e93b42b2 18462->18466 18467 7ff7e93b4178 45 API calls 18463->18467 18468 7ff7e93b9bf0 _invalid_parameter_noinfo 37 API calls 18464->18468 18465->18370 18470 7ff7e93b9bf0 _invalid_parameter_noinfo 37 API calls 18466->18470 18471 7ff7e93b42bd 18467->18471 18469 7ff7e93b4272 18468->18469 18469->18370 18470->18471 18471->18370 18473 7ff7e93a3ae6 18472->18473 18536 7ff7e93b51d8 18535->18536 18537 7ff7e93b51fe 18536->18537 18540 7ff7e93b5231 18536->18540 18538 7ff7e93b43f4 _get_daylight 11 API calls 18537->18538 18539 7ff7e93b5203 18538->18539 18541 7ff7e93b9bf0 _invalid_parameter_noinfo 37 API calls 18539->18541 18542 7ff7e93b5244 18540->18542 18543 7ff7e93b5237 18540->18543 18547 7ff7e93a3fc6 18541->18547 18554 7ff7e93b9f38 18542->18554 18545 7ff7e93b43f4 _get_daylight 11 API calls 18543->18545 18545->18547 18547->17350 18567 7ff7e93bf5e8 EnterCriticalSection 18554->18567 18927 7ff7e93b6c08 18926->18927 18930 7ff7e93b66e4 18927->18930 18929 7ff7e93b6c21 18929->17360 18931 7ff7e93b66ff 18930->18931 18932 7ff7e93b672e 18930->18932 18934 7ff7e93b9b24 _invalid_parameter_noinfo 37 API calls 18931->18934 18940 7ff7e93b477c EnterCriticalSection 18932->18940 18936 7ff7e93b671f 18934->18936 18936->18929 18942 7ff7e93af191 18941->18942 18943 7ff7e93af163 18941->18943 18945 7ff7e93af183 18942->18945 18951 7ff7e93b477c EnterCriticalSection 18942->18951 18944 7ff7e93b9b24 _invalid_parameter_noinfo 37 API calls 18943->18944 18944->18945 18945->17364 18953 7ff7e93a86b0 2 API calls 18952->18953 18954 7ff7e93a81b4 LoadLibraryExW 18953->18954 18955 7ff7e93a81d3 __std_exception_destroy 18954->18955 18955->17394 18957 7ff7e93a6ef3 GetProcAddress 18956->18957 18958 7ff7e93a6ec9 18956->18958 18957->18958 18959 7ff7e93a6f18 GetProcAddress 18957->18959 18960 7ff7e93a29e0 51 API calls 18958->18960 18959->18958 18961 7ff7e93a6f3d GetProcAddress 18959->18961 18962 7ff7e93a6ee3 18960->18962 18961->18958 18962->17401 19022 7ff7e93a5b05 19021->19022 19023 7ff7e93a1bf0 49 API calls 19022->19023 19024 7ff7e93a5b41 19023->19024 19025 7ff7e93a5b4a 19024->19025 19026 7ff7e93a5b6d 19024->19026 19027 7ff7e93a25f0 53 API calls 19025->19027 19028 7ff7e93a3fe0 49 API calls 19026->19028 19044 7ff7e93a5b63 19027->19044 19029 7ff7e93a5b85 19028->19029 19030 7ff7e93a5ba3 19029->19030 19032 7ff7e93a25f0 53 API calls 19029->19032 19033 7ff7e93a3f10 10 API calls 19030->19033 19031 7ff7e93ab870 _log10_special 8 API calls 19034 7ff7e93a308e 19031->19034 19032->19030 19035 7ff7e93a5bad 19033->19035 19034->17434 19052 7ff7e93a5c80 19034->19052 19036 7ff7e93a5bbb 19035->19036 19037 7ff7e93a81a0 3 API calls 19035->19037 19038 7ff7e93a3fe0 49 API calls 19036->19038 19037->19036 19039 7ff7e93a5bd4 19038->19039 19040 7ff7e93a5bf9 19039->19040 19041 7ff7e93a5bd9 19039->19041 19043 7ff7e93a81a0 3 API calls 19040->19043 19042 7ff7e93a25f0 53 API calls 19041->19042 19042->19044 19045 7ff7e93a5c06 19043->19045 19044->19031 19191 7ff7e93a4c80 19052->19191 19054 7ff7e93a5cba 19055 7ff7e93a5cc2 19054->19055 19056 7ff7e93a5cd3 19054->19056 19057 7ff7e93a25f0 53 API calls 19055->19057 19198 7ff7e93a4450 19056->19198 19193 7ff7e93a4cac 19191->19193 19192 7ff7e93a4cb4 19192->19054 19193->19192 19195 7ff7e93a4e54 19193->19195 19229 7ff7e93b5db4 19193->19229 19194 7ff7e93a5017 __std_exception_destroy 19194->19054 19195->19194 19196 7ff7e93a4180 47 API calls 19195->19196 19196->19195 19230 7ff7e93b5de4 19229->19230 19233 7ff7e93b52b0 19230->19233 19234 7ff7e93b52e1 19233->19234 19235 7ff7e93b52f3 19233->19235 19294->17437 19296 7ff7e93b472b 19295->19296 19304 7ff7e93be5b4 19296->19304 19317 7ff7e93bf5e8 EnterCriticalSection 19304->19317 19861 7ff7e93c9ef3 19862 7ff7e93c9f03 19861->19862 19865 7ff7e93b4788 LeaveCriticalSection 19862->19865 19369 7ff7e93abe70 19370 7ff7e93abe80 19369->19370 19386 7ff7e93b8ec0 19370->19386 19372 7ff7e93abe8c 19392 7ff7e93ac168 19372->19392 19374 7ff7e93ac44c 7 API calls 19375 7ff7e93abf25 19374->19375 19376 7ff7e93abea4 _RTC_Initialize 19384 7ff7e93abef9 19376->19384 19397 7ff7e93ac318 19376->19397 19378 7ff7e93abeb9 19400 7ff7e93b832c 19378->19400 19384->19374 19385 7ff7e93abf15 19384->19385 19387 7ff7e93b8ed1 19386->19387 19388 7ff7e93b8ed9 19387->19388 19389 7ff7e93b43f4 _get_daylight 11 API calls 19387->19389 19388->19372 19390 7ff7e93b8ee8 19389->19390 19391 7ff7e93b9bf0 _invalid_parameter_noinfo 37 API calls 19390->19391 19391->19388 19393 7ff7e93ac179 19392->19393 19396 7ff7e93ac17e __scrt_acquire_startup_lock 19392->19396 19394 7ff7e93ac44c 7 API calls 19393->19394 19393->19396 19395 7ff7e93ac1f2 19394->19395 19396->19376 19425 7ff7e93ac2dc 19397->19425 19399 7ff7e93ac321 19399->19378 19401 7ff7e93b834c 19400->19401 19423 7ff7e93abec5 19400->19423 19402 7ff7e93b8354 19401->19402 19403 7ff7e93b836a GetModuleFileNameW 19401->19403 19404 7ff7e93b43f4 _get_daylight 11 API calls 19402->19404 19407 7ff7e93b8395 19403->19407 19405 7ff7e93b8359 19404->19405 19406 7ff7e93b9bf0 _invalid_parameter_noinfo 37 API calls 19405->19406 19406->19423 19440 7ff7e93b82cc 19407->19440 19410 7ff7e93b83dd 19411 7ff7e93b43f4 _get_daylight 11 API calls 19410->19411 19412 7ff7e93b83e2 19411->19412 19414 7ff7e93b9c58 __free_lconv_mon 11 API calls 19412->19414 19413 7ff7e93b8417 19416 7ff7e93b9c58 __free_lconv_mon 11 API calls 19413->19416 19414->19423 19415 7ff7e93b83f5 19415->19413 19417 7ff7e93b8443 19415->19417 19418 7ff7e93b845c 19415->19418 19416->19423 19419 7ff7e93b9c58 __free_lconv_mon 11 API calls 19417->19419 19420 7ff7e93b9c58 __free_lconv_mon 11 API calls 19418->19420 19421 7ff7e93b844c 19419->19421 19420->19413 19422 7ff7e93b9c58 __free_lconv_mon 11 API calls 19421->19422 19422->19423 19423->19384 19424 7ff7e93ac3ec InitializeSListHead 19423->19424 19426 7ff7e93ac2f6 19425->19426 19428 7ff7e93ac2ef 19425->19428 19429 7ff7e93b94fc 19426->19429 19428->19399 19432 7ff7e93b9138 19429->19432 19439 7ff7e93bf5e8 EnterCriticalSection 19432->19439 19441 7ff7e93b82e4 19440->19441 19445 7ff7e93b831c 19440->19445 19442 7ff7e93bdea8 _get_daylight 11 API calls 19441->19442 19441->19445 19443 7ff7e93b8312 19442->19443 19444 7ff7e93b9c58 __free_lconv_mon 11 API calls 19443->19444 19444->19445 19445->19410 19445->19415 15756 7ff7e93aae00 15757 7ff7e93aae2e 15756->15757 15758 7ff7e93aae15 15756->15758 15758->15757 15761 7ff7e93bc90c 15758->15761 15762 7ff7e93bc957 15761->15762 15766 7ff7e93bc91b _get_daylight 15761->15766 15771 7ff7e93b43f4 15762->15771 15763 7ff7e93bc93e HeapAlloc 15765 7ff7e93aae8e 15763->15765 15763->15766 15766->15762 15766->15763 15768 7ff7e93c28a0 15766->15768 15774 7ff7e93c28e0 15768->15774 15780 7ff7e93ba5d8 GetLastError 15771->15780 15773 7ff7e93b43fd 15773->15765 15779 7ff7e93bf5e8 EnterCriticalSection 15774->15779 15781 7ff7e93ba619 FlsSetValue 15780->15781 15786 7ff7e93ba5fc 15780->15786 15782 7ff7e93ba609 SetLastError 15781->15782 15783 7ff7e93ba62b 15781->15783 15782->15773 15797 7ff7e93bdea8 15783->15797 15786->15781 15786->15782 15788 7ff7e93ba658 FlsSetValue 15791 7ff7e93ba676 15788->15791 15792 7ff7e93ba664 FlsSetValue 15788->15792 15789 7ff7e93ba648 FlsSetValue 15790 7ff7e93ba651 15789->15790 15804 7ff7e93b9c58 15790->15804 15810 7ff7e93ba204 15791->15810 15792->15790 15802 7ff7e93bdeb9 _get_daylight 15797->15802 15798 7ff7e93bdf0a 15801 7ff7e93b43f4 _get_daylight 10 API calls 15798->15801 15799 7ff7e93bdeee HeapAlloc 15800 7ff7e93ba63a 15799->15800 15799->15802 15800->15788 15800->15789 15801->15800 15802->15798 15802->15799 15803 7ff7e93c28a0 _get_daylight 2 API calls 15802->15803 15803->15802 15805 7ff7e93b9c5d RtlFreeHeap 15804->15805 15807 7ff7e93b9c8c 15804->15807 15806 7ff7e93b9c78 GetLastError 15805->15806 15805->15807 15808 7ff7e93b9c85 __free_lconv_mon 15806->15808 15807->15782 15809 7ff7e93b43f4 _get_daylight 9 API calls 15808->15809 15809->15807 15815 7ff7e93ba0dc 15810->15815 15827 7ff7e93bf5e8 EnterCriticalSection 15815->15827 15829 7ff7e93b8c79 15841 7ff7e93b96e8 15829->15841 15846 7ff7e93ba460 GetLastError 15841->15846 15847 7ff7e93ba4a1 FlsSetValue 15846->15847 15848 7ff7e93ba484 FlsGetValue 15846->15848 15850 7ff7e93ba4b3 15847->15850 15865 7ff7e93ba491 15847->15865 15849 7ff7e93ba49b 15848->15849 15848->15865 15849->15847 15852 7ff7e93bdea8 _get_daylight 11 API calls 15850->15852 15851 7ff7e93ba50d SetLastError 15854 7ff7e93b96f1 15851->15854 15855 7ff7e93ba52d 15851->15855 15853 7ff7e93ba4c2 15852->15853 15857 7ff7e93ba4e0 FlsSetValue 15853->15857 15858 7ff7e93ba4d0 FlsSetValue 15853->15858 15868 7ff7e93b9814 15854->15868 15856 7ff7e93b9814 _CreateFrameInfo 38 API calls 15855->15856 15859 7ff7e93ba532 15856->15859 15861 7ff7e93ba4fe 15857->15861 15862 7ff7e93ba4ec FlsSetValue 15857->15862 15860 7ff7e93ba4d9 15858->15860 15863 7ff7e93b9c58 __free_lconv_mon 11 API calls 15860->15863 15864 7ff7e93ba204 _get_daylight 11 API calls 15861->15864 15862->15860 15863->15865 15866 7ff7e93ba506 15864->15866 15865->15851 15867 7ff7e93b9c58 __free_lconv_mon 11 API calls 15866->15867 15867->15851 15877 7ff7e93c2960 15868->15877 15911 7ff7e93c2918 15877->15911 15916 7ff7e93bf5e8 EnterCriticalSection 15911->15916 19609 7ff7e93ca079 19612 7ff7e93b4788 LeaveCriticalSection 19609->19612 19951 7ff7e93ca10e 19952 7ff7e93ca11d 19951->19952 19953 7ff7e93ca127 19951->19953 19955 7ff7e93bf648 LeaveCriticalSection 19952->19955 16905 7ff7e93bec9c 16906 7ff7e93bee8e 16905->16906 16908 7ff7e93becde _isindst 16905->16908 16907 7ff7e93b43f4 _get_daylight 11 API calls 16906->16907 16925 7ff7e93bee7e 16907->16925 16908->16906 16911 7ff7e93bed5e _isindst 16908->16911 16909 7ff7e93ab870 _log10_special 8 API calls 16910 7ff7e93beea9 16909->16910 16926 7ff7e93c54a4 16911->16926 16916 7ff7e93beeba 16918 7ff7e93b9c10 _isindst 17 API calls 16916->16918 16919 7ff7e93beece 16918->16919 16923 7ff7e93bedbb 16923->16925 16951 7ff7e93c54e8 16923->16951 16925->16909 16927 7ff7e93bed7c 16926->16927 16928 7ff7e93c54b3 16926->16928 16933 7ff7e93c48a8 16927->16933 16958 7ff7e93bf5e8 EnterCriticalSection 16928->16958 16934 7ff7e93c48b1 16933->16934 16938 7ff7e93bed91 16933->16938 16935 7ff7e93b43f4 _get_daylight 11 API calls 16934->16935 16936 7ff7e93c48b6 16935->16936 16937 7ff7e93b9bf0 _invalid_parameter_noinfo 37 API calls 16936->16937 16937->16938 16938->16916 16939 7ff7e93c48d8 16938->16939 16940 7ff7e93c48e1 16939->16940 16941 7ff7e93beda2 16939->16941 16942 7ff7e93b43f4 _get_daylight 11 API calls 16940->16942 16941->16916 16945 7ff7e93c4908 16941->16945 16943 7ff7e93c48e6 16942->16943 16944 7ff7e93b9bf0 _invalid_parameter_noinfo 37 API calls 16943->16944 16944->16941 16946 7ff7e93c4911 16945->16946 16950 7ff7e93bedb3 16945->16950 16947 7ff7e93b43f4 _get_daylight 11 API calls 16946->16947 16948 7ff7e93c4916 16947->16948 16949 7ff7e93b9bf0 _invalid_parameter_noinfo 37 API calls 16948->16949 16949->16950 16950->16916 16950->16923 16959 7ff7e93bf5e8 EnterCriticalSection 16951->16959 19651 7ff7e93bb830 19662 7ff7e93bf5e8 EnterCriticalSection 19651->19662 20228 7ff7e93c09c0 20239 7ff7e93c66f4 20228->20239 20240 7ff7e93c6701 20239->20240 20241 7ff7e93b9c58 __free_lconv_mon 11 API calls 20240->20241 20242 7ff7e93c671d 20240->20242 20241->20240 20243 7ff7e93b9c58 __free_lconv_mon 11 API calls 20242->20243 20244 7ff7e93c09c9 20242->20244 20243->20242 20245 7ff7e93bf5e8 EnterCriticalSection 20244->20245 16695 7ff7e93b4938 16696 7ff7e93b4952 16695->16696 16697 7ff7e93b496f 16695->16697 16746 7ff7e93b43d4 16696->16746 16697->16696 16698 7ff7e93b4982 CreateFileW 16697->16698 16701 7ff7e93b49b6 16698->16701 16702 7ff7e93b49ec 16698->16702 16720 7ff7e93b4a8c GetFileType 16701->16720 16749 7ff7e93b4f14 16702->16749 16703 7ff7e93b43f4 _get_daylight 11 API calls 16706 7ff7e93b495f 16703->16706 16709 7ff7e93b9bf0 _invalid_parameter_noinfo 37 API calls 16706->16709 16716 7ff7e93b496a 16709->16716 16710 7ff7e93b49e1 CloseHandle 16710->16716 16711 7ff7e93b49cb CloseHandle 16711->16716 16712 7ff7e93b4a20 16770 7ff7e93b4cd4 16712->16770 16713 7ff7e93b49f5 16714 7ff7e93b4368 _fread_nolock 11 API calls 16713->16714 16719 7ff7e93b49ff 16714->16719 16719->16716 16721 7ff7e93b4ada 16720->16721 16722 7ff7e93b4b97 16720->16722 16723 7ff7e93b4b06 GetFileInformationByHandle 16721->16723 16727 7ff7e93b4e10 21 API calls 16721->16727 16724 7ff7e93b4bc1 16722->16724 16725 7ff7e93b4b9f 16722->16725 16728 7ff7e93b4bb2 GetLastError 16723->16728 16729 7ff7e93b4b2f 16723->16729 16726 7ff7e93b4be4 PeekNamedPipe 16724->16726 16732 7ff7e93b4b82 16724->16732 16725->16728 16730 7ff7e93b4ba3 16725->16730 16726->16732 16733 7ff7e93b4af4 16727->16733 16731 7ff7e93b4368 _fread_nolock 11 API calls 16728->16731 16734 7ff7e93b4cd4 51 API calls 16729->16734 16735 7ff7e93b43f4 _get_daylight 11 API calls 16730->16735 16731->16732 16736 7ff7e93ab870 _log10_special 8 API calls 16732->16736 16733->16723 16733->16732 16737 7ff7e93b4b3a 16734->16737 16735->16732 16738 7ff7e93b49c4 16736->16738 16787 7ff7e93b4c34 16737->16787 16738->16710 16738->16711 16741 7ff7e93b4c34 10 API calls 16742 7ff7e93b4b59 16741->16742 16743 7ff7e93b4c34 10 API calls 16742->16743 16744 7ff7e93b4b6a 16743->16744 16744->16732 16745 7ff7e93b43f4 _get_daylight 11 API calls 16744->16745 16745->16732 16747 7ff7e93ba5d8 _get_daylight 11 API calls 16746->16747 16748 7ff7e93b43dd 16747->16748 16748->16703 16750 7ff7e93b4f4a 16749->16750 16751 7ff7e93b43f4 _get_daylight 11 API calls 16750->16751 16764 7ff7e93b4fe2 __std_exception_destroy 16750->16764 16753 7ff7e93b4f5c 16751->16753 16752 7ff7e93ab870 _log10_special 8 API calls 16754 7ff7e93b49f1 16752->16754 16755 7ff7e93b43f4 _get_daylight 11 API calls 16753->16755 16754->16712 16754->16713 16756 7ff7e93b4f64 16755->16756 16794 7ff7e93b7118 16756->16794 16758 7ff7e93b4f79 16759 7ff7e93b4f81 16758->16759 16760 7ff7e93b4f8b 16758->16760 16761 7ff7e93b43f4 _get_daylight 11 API calls 16759->16761 16762 7ff7e93b43f4 _get_daylight 11 API calls 16760->16762 16769 7ff7e93b4f86 16761->16769 16763 7ff7e93b4f90 16762->16763 16763->16764 16765 7ff7e93b43f4 _get_daylight 11 API calls 16763->16765 16764->16752 16766 7ff7e93b4f9a 16765->16766 16767 7ff7e93b7118 45 API calls 16766->16767 16767->16769 16768 7ff7e93b4fd4 GetDriveTypeW 16768->16764 16769->16764 16769->16768 16771 7ff7e93b4cfc 16770->16771 16779 7ff7e93b4a2d 16771->16779 16888 7ff7e93bea34 16771->16888 16773 7ff7e93b4d90 16774 7ff7e93bea34 51 API calls 16773->16774 16773->16779 16775 7ff7e93b4da3 16774->16775 16776 7ff7e93bea34 51 API calls 16775->16776 16775->16779 16777 7ff7e93b4db6 16776->16777 16778 7ff7e93bea34 51 API calls 16777->16778 16777->16779 16778->16779 16780 7ff7e93b4e10 16779->16780 16781 7ff7e93b4e2a 16780->16781 16782 7ff7e93b4e61 16781->16782 16783 7ff7e93b4e3a 16781->16783 16784 7ff7e93be8c8 21 API calls 16782->16784 16785 7ff7e93b4368 _fread_nolock 11 API calls 16783->16785 16786 7ff7e93b4e4a 16783->16786 16784->16786 16785->16786 16786->16719 16788 7ff7e93b4c50 16787->16788 16789 7ff7e93b4c5d FileTimeToSystemTime 16787->16789 16788->16789 16791 7ff7e93b4c58 16788->16791 16790 7ff7e93b4c71 SystemTimeToTzSpecificLocalTime 16789->16790 16789->16791 16790->16791 16792 7ff7e93ab870 _log10_special 8 API calls 16791->16792 16793 7ff7e93b4b49 16792->16793 16793->16741 16795 7ff7e93b71a2 16794->16795 16796 7ff7e93b7134 16794->16796 16831 7ff7e93bfad0 16795->16831 16796->16795 16798 7ff7e93b7139 16796->16798 16799 7ff7e93b7151 16798->16799 16800 7ff7e93b716e 16798->16800 16806 7ff7e93b6ee8 GetFullPathNameW 16799->16806 16814 7ff7e93b6f5c GetFullPathNameW 16800->16814 16805 7ff7e93b7166 __std_exception_destroy 16805->16758 16807 7ff7e93b6f24 16806->16807 16808 7ff7e93b6f0e GetLastError 16806->16808 16812 7ff7e93b43f4 _get_daylight 11 API calls 16807->16812 16813 7ff7e93b6f20 16807->16813 16809 7ff7e93b4368 _fread_nolock 11 API calls 16808->16809 16810 7ff7e93b6f1b 16809->16810 16811 7ff7e93b43f4 _get_daylight 11 API calls 16810->16811 16811->16813 16812->16813 16813->16805 16815 7ff7e93b6f8f GetLastError 16814->16815 16819 7ff7e93b6fa5 __std_exception_destroy 16814->16819 16816 7ff7e93b4368 _fread_nolock 11 API calls 16815->16816 16817 7ff7e93b6f9c 16816->16817 16818 7ff7e93b43f4 _get_daylight 11 API calls 16817->16818 16820 7ff7e93b6fa1 16818->16820 16819->16820 16821 7ff7e93b6fff GetFullPathNameW 16819->16821 16822 7ff7e93b7034 16820->16822 16821->16815 16821->16820 16823 7ff7e93b70a8 memcpy_s 16822->16823 16824 7ff7e93b705d __scrt_get_show_window_mode 16822->16824 16823->16805 16824->16823 16825 7ff7e93b7091 16824->16825 16828 7ff7e93b70ca 16824->16828 16826 7ff7e93b43f4 _get_daylight 11 API calls 16825->16826 16827 7ff7e93b7096 16826->16827 16829 7ff7e93b9bf0 _invalid_parameter_noinfo 37 API calls 16827->16829 16828->16823 16830 7ff7e93b43f4 _get_daylight 11 API calls 16828->16830 16829->16823 16830->16827 16834 7ff7e93bf8e0 16831->16834 16835 7ff7e93bf922 16834->16835 16836 7ff7e93bf90b 16834->16836 16838 7ff7e93bf926 16835->16838 16839 7ff7e93bf947 16835->16839 16837 7ff7e93b43f4 _get_daylight 11 API calls 16836->16837 16842 7ff7e93bf910 16837->16842 16860 7ff7e93bfa4c 16838->16860 16872 7ff7e93be8c8 16839->16872 16846 7ff7e93b9bf0 _invalid_parameter_noinfo 37 API calls 16842->16846 16844 7ff7e93bf94c 16849 7ff7e93bf9f1 16844->16849 16855 7ff7e93bf973 16844->16855 16845 7ff7e93bf92f 16847 7ff7e93b43d4 _fread_nolock 11 API calls 16845->16847 16859 7ff7e93bf91b __std_exception_destroy 16846->16859 16848 7ff7e93bf934 16847->16848 16851 7ff7e93b43f4 _get_daylight 11 API calls 16848->16851 16849->16836 16852 7ff7e93bf9f9 16849->16852 16850 7ff7e93ab870 _log10_special 8 API calls 16853 7ff7e93bfa41 16850->16853 16851->16842 16854 7ff7e93b6ee8 13 API calls 16852->16854 16853->16805 16854->16859 16856 7ff7e93b6f5c 14 API calls 16855->16856 16857 7ff7e93bf9b7 16856->16857 16858 7ff7e93b7034 37 API calls 16857->16858 16857->16859 16858->16859 16859->16850 16861 7ff7e93bfa96 16860->16861 16862 7ff7e93bfa66 16860->16862 16863 7ff7e93bfaa1 GetDriveTypeW 16861->16863 16864 7ff7e93bfa81 16861->16864 16865 7ff7e93b43d4 _fread_nolock 11 API calls 16862->16865 16863->16864 16868 7ff7e93ab870 _log10_special 8 API calls 16864->16868 16866 7ff7e93bfa6b 16865->16866 16867 7ff7e93b43f4 _get_daylight 11 API calls 16866->16867 16869 7ff7e93bfa76 16867->16869 16870 7ff7e93bf92b 16868->16870 16871 7ff7e93b9bf0 _invalid_parameter_noinfo 37 API calls 16869->16871 16870->16844 16870->16845 16871->16864 16886 7ff7e93c97e0 16872->16886 16875 7ff7e93be915 16879 7ff7e93ab870 _log10_special 8 API calls 16875->16879 16876 7ff7e93be93c 16877 7ff7e93bdea8 _get_daylight 11 API calls 16876->16877 16878 7ff7e93be94b 16877->16878 16880 7ff7e93be955 GetCurrentDirectoryW 16878->16880 16881 7ff7e93be964 16878->16881 16882 7ff7e93be9a9 16879->16882 16880->16881 16883 7ff7e93be969 16880->16883 16884 7ff7e93b43f4 _get_daylight 11 API calls 16881->16884 16882->16844 16885 7ff7e93b9c58 __free_lconv_mon 11 API calls 16883->16885 16884->16883 16885->16875 16887 7ff7e93be8fe GetCurrentDirectoryW 16886->16887 16887->16875 16887->16876 16889 7ff7e93bea41 16888->16889 16890 7ff7e93bea65 16888->16890 16889->16890 16891 7ff7e93bea46 16889->16891 16892 7ff7e93bea9f 16890->16892 16895 7ff7e93beabe 16890->16895 16893 7ff7e93b43f4 _get_daylight 11 API calls 16891->16893 16894 7ff7e93b43f4 _get_daylight 11 API calls 16892->16894 16896 7ff7e93bea4b 16893->16896 16897 7ff7e93beaa4 16894->16897 16898 7ff7e93b4178 45 API calls 16895->16898 16899 7ff7e93b9bf0 _invalid_parameter_noinfo 37 API calls 16896->16899 16900 7ff7e93b9bf0 _invalid_parameter_noinfo 37 API calls 16897->16900 16903 7ff7e93beacb 16898->16903 16901 7ff7e93bea56 16899->16901 16902 7ff7e93beaaf 16900->16902 16901->16773 16902->16773 16903->16902 16904 7ff7e93bf7ec 51 API calls 16903->16904 16904->16903

                                                                                                                                                                                                                            Executed Functions

                                                                                                                                                                                                                            Function 00007FF7E93A1000 Relevance: 40.6, APIs: 5, Strings: 18, Instructions: 338COMMON
                                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                                            control_flow_graph 0 7ff7e93a1000-7ff7e93a3536 call 7ff7e93af138 call 7ff7e93af140 call 7ff7e93abb70 call 7ff7e93b4700 call 7ff7e93b4794 call 7ff7e93a33e0 14 7ff7e93a3544-7ff7e93a3566 call 7ff7e93a18f0 0->14 15 7ff7e93a3538-7ff7e93a353f 0->15 20 7ff7e93a3736-7ff7e93a374c call 7ff7e93a3f70 14->20 21 7ff7e93a356c-7ff7e93a3583 call 7ff7e93a1bf0 14->21 16 7ff7e93a371a-7ff7e93a3735 call 7ff7e93ab870 15->16 29 7ff7e93a3785-7ff7e93a379a call 7ff7e93a25f0 20->29 30 7ff7e93a374e-7ff7e93a377b call 7ff7e93a76a0 20->30 25 7ff7e93a3588-7ff7e93a35c1 21->25 27 7ff7e93a3653-7ff7e93a366d call 7ff7e93a7e10 25->27 28 7ff7e93a35c7-7ff7e93a35cb 25->28 44 7ff7e93a366f-7ff7e93a3675 27->44 45 7ff7e93a3695-7ff7e93a369c 27->45 32 7ff7e93a3638-7ff7e93a364d call 7ff7e93a18e0 28->32 33 7ff7e93a35cd-7ff7e93a35e5 call 7ff7e93b4560 28->33 47 7ff7e93a3712 29->47 41 7ff7e93a379f-7ff7e93a37be call 7ff7e93a1bf0 30->41 42 7ff7e93a377d-7ff7e93a3780 call 7ff7e93af36c 30->42 32->27 32->28 52 7ff7e93a35f2-7ff7e93a360a call 7ff7e93b4560 33->52 53 7ff7e93a35e7-7ff7e93a35eb 33->53 61 7ff7e93a37c1-7ff7e93a37ca 41->61 42->29 50 7ff7e93a3682-7ff7e93a3690 call 7ff7e93b415c 44->50 51 7ff7e93a3677-7ff7e93a3680 44->51 54 7ff7e93a36a2-7ff7e93a36c0 call 7ff7e93a7e10 call 7ff7e93a7f80 45->54 55 7ff7e93a3844-7ff7e93a3863 call 7ff7e93a3e90 45->55 47->16 50->45 51->50 68 7ff7e93a3617-7ff7e93a362f call 7ff7e93b4560 52->68 69 7ff7e93a360c-7ff7e93a3610 52->69 53->52 76 7ff7e93a380f-7ff7e93a381e call 7ff7e93a8400 54->76 77 7ff7e93a36c6-7ff7e93a36c9 54->77 65 7ff7e93a3871-7ff7e93a3882 call 7ff7e93a1bf0 55->65 66 7ff7e93a3865-7ff7e93a386f call 7ff7e93a3fe0 55->66 61->61 67 7ff7e93a37cc-7ff7e93a37e9 call 7ff7e93a18f0 61->67 79 7ff7e93a3887-7ff7e93a38a1 call 7ff7e93a86b0 65->79 66->79 67->25 85 7ff7e93a37ef-7ff7e93a3800 call 7ff7e93a25f0 67->85 68->32 86 7ff7e93a3631 68->86 69->68 92 7ff7e93a3820 76->92 93 7ff7e93a382c-7ff7e93a382f call 7ff7e93a7c40 76->93 77->76 82 7ff7e93a36cf-7ff7e93a36f6 call 7ff7e93a1bf0 77->82 94 7ff7e93a38af-7ff7e93a38c1 SetDllDirectoryW 79->94 95 7ff7e93a38a3 79->95 97 7ff7e93a3805-7ff7e93a380d call 7ff7e93b415c 82->97 98 7ff7e93a36fc-7ff7e93a3703 call 7ff7e93a25f0 82->98 85->47 86->32 92->93 104 7ff7e93a3834-7ff7e93a3836 93->104 100 7ff7e93a38d0-7ff7e93a38ec call 7ff7e93a6560 call 7ff7e93a6b00 94->100 101 7ff7e93a38c3-7ff7e93a38ca 94->101 95->94 97->79 108 7ff7e93a3708-7ff7e93a370a 98->108 117 7ff7e93a3947-7ff7e93a394a call 7ff7e93a6510 100->117 118 7ff7e93a38ee-7ff7e93a38f4 100->118 101->100 105 7ff7e93a3a50-7ff7e93a3a58 101->105 104->79 111 7ff7e93a3838 104->111 109 7ff7e93a3a5a-7ff7e93a3a77 PostMessageW GetMessageW 105->109 110 7ff7e93a3a7d-7ff7e93a3aaf call 7ff7e93a33d0 call 7ff7e93a3080 call 7ff7e93a33a0 call 7ff7e93a6780 call 7ff7e93a6510 105->110 108->47 109->110 111->55 125 7ff7e93a394f-7ff7e93a3956 117->125 120 7ff7e93a38f6-7ff7e93a3903 call 7ff7e93a65a0 118->120 121 7ff7e93a390e-7ff7e93a3918 call 7ff7e93a6970 118->121 120->121 133 7ff7e93a3905-7ff7e93a390c 120->133 135 7ff7e93a3923-7ff7e93a3931 call 7ff7e93a6cd0 121->135 136 7ff7e93a391a-7ff7e93a3921 121->136 125->105 129 7ff7e93a395c-7ff7e93a3966 call 7ff7e93a30e0 125->129 129->108 142 7ff7e93a396c-7ff7e93a3980 call 7ff7e93a83e0 129->142 138 7ff7e93a393a-7ff7e93a3942 call 7ff7e93a2870 call 7ff7e93a6780 133->138 135->125 148 7ff7e93a3933 135->148 136->138 138->117 151 7ff7e93a3982-7ff7e93a399f PostMessageW GetMessageW 142->151 152 7ff7e93a39a5-7ff7e93a39e1 call 7ff7e93a7f20 call 7ff7e93a7fc0 call 7ff7e93a6780 call 7ff7e93a6510 call 7ff7e93a7ec0 142->152 148->138 151->152 162 7ff7e93a39e6-7ff7e93a39e8 152->162 163 7ff7e93a39ea-7ff7e93a3a00 call 7ff7e93a81f0 call 7ff7e93a7ec0 162->163 164 7ff7e93a3a3d-7ff7e93a3a4b call 7ff7e93a18a0 162->164 163->164 171 7ff7e93a3a02-7ff7e93a3a10 163->171 164->108 172 7ff7e93a3a12-7ff7e93a3a2c call 7ff7e93a25f0 call 7ff7e93a18a0 171->172 173 7ff7e93a3a31-7ff7e93a3a38 call 7ff7e93a2870 171->173 172->108 173->164
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.3006178811.00007FF7E93A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E93A0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006139504.00007FF7E93A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006229148.00007FF7E93CB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93DE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006337234.00007FF7E93E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff7e93a0000_1.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: FileModuleName
                                                                                                                                                                                                                            • String ID: Could not create temporary directory!$Could not load PyInstaller's embedded PKG archive from the executable (%s)$Could not side-load PyInstaller's PKG archive from external file (%s)$ERROR: failed to remove temporary directory: %s$Failed to convert DLL search path!$Failed to initialize security descriptor for temporary directory!$Failed to load Tcl/Tk shared libraries for splash screen!$Failed to start splash screen!$Failed to unpack splash screen dependencies from PKG archive!$MEI$PYINSTALLER_STRICT_UNPACK_MODE$Path exceeds PYI_PATH_MAX limit.$WARNING: failed to remove temporary directory: %s$_MEIPASS2$pkg$pyi-contents-directory$pyi-disable-windowed-traceback$pyi-runtime-tmpdir
                                                                                                                                                                                                                            • API String ID: 514040917-585287483
                                                                                                                                                                                                                            • Opcode ID: 1ab915059f083da480bb5f8b0769b4ec97db141b1d5f92c49b7faf13479d9f29
                                                                                                                                                                                                                            • Instruction ID: 6af46c2fa34d1c0e520f9c4c961316605fd0b66f6b54f8d317267cf345390c72
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 1ab915059f083da480bb5f8b0769b4ec97db141b1d5f92c49b7faf13479d9f29
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: EBF17023A08A8251EA18FF21D5543F9E271AF65780FC4443BDA5D436D6EFBCE958C322
                                                                                                                                                                                                                            Function 00007FF7E93C4F10 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 334timeCOMMON
                                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                                            control_flow_graph 305 7ff7e93c4f10-7ff7e93c4f4b call 7ff7e93c4898 call 7ff7e93c48a0 call 7ff7e93c4908 312 7ff7e93c4f51-7ff7e93c4f5c call 7ff7e93c48a8 305->312 313 7ff7e93c5175-7ff7e93c51c1 call 7ff7e93b9c10 call 7ff7e93c4898 call 7ff7e93c48a0 call 7ff7e93c4908 305->313 312->313 318 7ff7e93c4f62-7ff7e93c4f6c 312->318 338 7ff7e93c52ff-7ff7e93c536d call 7ff7e93b9c10 call 7ff7e93c0888 313->338 339 7ff7e93c51c7-7ff7e93c51d2 call 7ff7e93c48a8 313->339 320 7ff7e93c4f8e-7ff7e93c4f92 318->320 321 7ff7e93c4f6e-7ff7e93c4f71 318->321 324 7ff7e93c4f95-7ff7e93c4f9d 320->324 323 7ff7e93c4f74-7ff7e93c4f7f 321->323 326 7ff7e93c4f81-7ff7e93c4f88 323->326 327 7ff7e93c4f8a-7ff7e93c4f8c 323->327 324->324 328 7ff7e93c4f9f-7ff7e93c4fb2 call 7ff7e93bc90c 324->328 326->323 326->327 327->320 330 7ff7e93c4fbb-7ff7e93c4fc9 327->330 336 7ff7e93c4fb4-7ff7e93c4fb6 call 7ff7e93b9c58 328->336 337 7ff7e93c4fca-7ff7e93c4fd6 call 7ff7e93b9c58 328->337 336->330 347 7ff7e93c4fdd-7ff7e93c4fe5 337->347 357 7ff7e93c536f-7ff7e93c5376 338->357 358 7ff7e93c537b-7ff7e93c537e 338->358 339->338 348 7ff7e93c51d8-7ff7e93c51e3 call 7ff7e93c48d8 339->348 347->347 350 7ff7e93c4fe7-7ff7e93c4ff8 call 7ff7e93bf784 347->350 348->338 359 7ff7e93c51e9-7ff7e93c520c call 7ff7e93b9c58 GetTimeZoneInformation 348->359 350->313 360 7ff7e93c4ffe-7ff7e93c5054 call 7ff7e93c97e0 * 4 call 7ff7e93c4e2c 350->360 361 7ff7e93c540b-7ff7e93c540e 357->361 362 7ff7e93c5380 358->362 363 7ff7e93c53b5-7ff7e93c53c8 call 7ff7e93bc90c 358->363 375 7ff7e93c5212-7ff7e93c5233 359->375 376 7ff7e93c52d4-7ff7e93c52fe call 7ff7e93c4890 call 7ff7e93c4880 call 7ff7e93c4888 359->376 418 7ff7e93c5056-7ff7e93c505a 360->418 368 7ff7e93c5383 call 7ff7e93c518c 361->368 370 7ff7e93c5414-7ff7e93c541c call 7ff7e93c4f10 361->370 362->368 379 7ff7e93c53d3-7ff7e93c53ee call 7ff7e93c0888 363->379 380 7ff7e93c53ca 363->380 381 7ff7e93c5388-7ff7e93c53b4 call 7ff7e93b9c58 call 7ff7e93ab870 368->381 370->381 382 7ff7e93c5235-7ff7e93c523b 375->382 383 7ff7e93c523e-7ff7e93c5245 375->383 403 7ff7e93c53f0-7ff7e93c53f3 379->403 404 7ff7e93c53f5-7ff7e93c5407 call 7ff7e93b9c58 379->404 387 7ff7e93c53cc-7ff7e93c53d1 call 7ff7e93b9c58 380->387 382->383 390 7ff7e93c5259 383->390 391 7ff7e93c5247-7ff7e93c524f 383->391 387->362 395 7ff7e93c525b-7ff7e93c52cf call 7ff7e93c97e0 * 4 call 7ff7e93c1e6c call 7ff7e93c5424 * 2 390->395 391->390 398 7ff7e93c5251-7ff7e93c5257 391->398 395->376 398->395 403->387 404->361 420 7ff7e93c5060-7ff7e93c5064 418->420 421 7ff7e93c505c 418->421 420->418 423 7ff7e93c5066-7ff7e93c508b call 7ff7e93b5e68 420->423 421->420 429 7ff7e93c508e-7ff7e93c5092 423->429 430 7ff7e93c50a1-7ff7e93c50a5 429->430 431 7ff7e93c5094-7ff7e93c509f 429->431 430->429 431->430 433 7ff7e93c50a7-7ff7e93c50ab 431->433 435 7ff7e93c50ad-7ff7e93c50d5 call 7ff7e93b5e68 433->435 436 7ff7e93c512c-7ff7e93c5130 433->436 445 7ff7e93c50f3-7ff7e93c50f7 435->445 446 7ff7e93c50d7 435->446 438 7ff7e93c5132-7ff7e93c5134 436->438 439 7ff7e93c5137-7ff7e93c5144 436->439 438->439 441 7ff7e93c515f-7ff7e93c516e call 7ff7e93c4890 call 7ff7e93c4880 439->441 442 7ff7e93c5146-7ff7e93c515c call 7ff7e93c4e2c 439->442 441->313 442->441 445->436 451 7ff7e93c50f9-7ff7e93c5117 call 7ff7e93b5e68 445->451 449 7ff7e93c50da-7ff7e93c50e1 446->449 449->445 452 7ff7e93c50e3-7ff7e93c50f1 449->452 457 7ff7e93c5123-7ff7e93c512a 451->457 452->445 452->449 457->436 458 7ff7e93c5119-7ff7e93c511d 457->458 458->436 459 7ff7e93c511f 458->459 459->457
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • _get_daylight.LIBCMT ref: 00007FF7E93C4F55
                                                                                                                                                                                                                              • Part of subcall function 00007FF7E93C48A8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7E93C48BC
                                                                                                                                                                                                                              • Part of subcall function 00007FF7E93B9C58: RtlFreeHeap.NTDLL(?,?,?,00007FF7E93C2032,?,?,?,00007FF7E93C206F,?,?,00000000,00007FF7E93C2535,?,?,?,00007FF7E93C2467), ref: 00007FF7E93B9C6E
                                                                                                                                                                                                                              • Part of subcall function 00007FF7E93B9C58: GetLastError.KERNEL32(?,?,?,00007FF7E93C2032,?,?,?,00007FF7E93C206F,?,?,00000000,00007FF7E93C2535,?,?,?,00007FF7E93C2467), ref: 00007FF7E93B9C78
                                                                                                                                                                                                                              • Part of subcall function 00007FF7E93B9C10: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF7E93B9BEF,?,?,?,?,?,00007FF7E93B9ADA), ref: 00007FF7E93B9C19
                                                                                                                                                                                                                              • Part of subcall function 00007FF7E93B9C10: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF7E93B9BEF,?,?,?,?,?,00007FF7E93B9ADA), ref: 00007FF7E93B9C3E
                                                                                                                                                                                                                            • _get_daylight.LIBCMT ref: 00007FF7E93C4F44
                                                                                                                                                                                                                              • Part of subcall function 00007FF7E93C4908: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7E93C491C
                                                                                                                                                                                                                            • _get_daylight.LIBCMT ref: 00007FF7E93C51BA
                                                                                                                                                                                                                            • _get_daylight.LIBCMT ref: 00007FF7E93C51CB
                                                                                                                                                                                                                            • _get_daylight.LIBCMT ref: 00007FF7E93C51DC
                                                                                                                                                                                                                            • GetTimeZoneInformation.KERNELBASE(?,?,?,?,?,?,?,?,?,00000000,?,00007FF7E93C541C), ref: 00007FF7E93C5203
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.3006178811.00007FF7E93A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E93A0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006139504.00007FF7E93A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006229148.00007FF7E93CB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93DE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006337234.00007FF7E93E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff7e93a0000_1.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: _get_daylight$_invalid_parameter_noinfo$CurrentErrorFeatureFreeHeapInformationLastPresentProcessProcessorTimeZone
                                                                                                                                                                                                                            • String ID: Eastern Standard Time$Eastern Summer Time
                                                                                                                                                                                                                            • API String ID: 4070488512-239921721
                                                                                                                                                                                                                            • Opcode ID: 0d3b627969e88128c8faa99a2c0e5d438b7f33ec3044a67c5b643e0657b8cf50
                                                                                                                                                                                                                            • Instruction ID: 8e8a73f3afe644f2326c3e9f823dc6ca8fc69fd2bed903598be326d5cd66dacd
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 0d3b627969e88128c8faa99a2c0e5d438b7f33ec3044a67c5b643e0657b8cf50
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: D8D18127A08A5285EB20BF25D8453BDA7B1EB64784FC5423BDA0D87785DE3CE841C771
                                                                                                                                                                                                                            Function 00007FF7E93C5C74 Relevance: 13.8, APIs: 9, Instructions: 276fileCOMMON
                                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                                            control_flow_graph 490 7ff7e93c5c74-7ff7e93c5ce7 call 7ff7e93c59a8 493 7ff7e93c5d01-7ff7e93c5d0b call 7ff7e93b7830 490->493 494 7ff7e93c5ce9-7ff7e93c5cf2 call 7ff7e93b43d4 490->494 499 7ff7e93c5d26-7ff7e93c5d8f CreateFileW 493->499 500 7ff7e93c5d0d-7ff7e93c5d24 call 7ff7e93b43d4 call 7ff7e93b43f4 493->500 501 7ff7e93c5cf5-7ff7e93c5cfc call 7ff7e93b43f4 494->501 503 7ff7e93c5d91-7ff7e93c5d97 499->503 504 7ff7e93c5e0c-7ff7e93c5e17 GetFileType 499->504 500->501 512 7ff7e93c6042-7ff7e93c6062 501->512 509 7ff7e93c5dd9-7ff7e93c5e07 GetLastError call 7ff7e93b4368 503->509 510 7ff7e93c5d99-7ff7e93c5d9d 503->510 506 7ff7e93c5e6a-7ff7e93c5e71 504->506 507 7ff7e93c5e19-7ff7e93c5e54 GetLastError call 7ff7e93b4368 CloseHandle 504->507 515 7ff7e93c5e73-7ff7e93c5e77 506->515 516 7ff7e93c5e79-7ff7e93c5e7c 506->516 507->501 524 7ff7e93c5e5a-7ff7e93c5e65 call 7ff7e93b43f4 507->524 509->501 510->509 517 7ff7e93c5d9f-7ff7e93c5dd7 CreateFileW 510->517 521 7ff7e93c5e82-7ff7e93c5ed7 call 7ff7e93b7748 515->521 516->521 522 7ff7e93c5e7e 516->522 517->504 517->509 529 7ff7e93c5ef6-7ff7e93c5f27 call 7ff7e93c5728 521->529 530 7ff7e93c5ed9-7ff7e93c5ee5 call 7ff7e93c5bb0 521->530 522->521 524->501 536 7ff7e93c5f29-7ff7e93c5f2b 529->536 537 7ff7e93c5f2d-7ff7e93c5f6f 529->537 530->529 535 7ff7e93c5ee7 530->535 538 7ff7e93c5ee9-7ff7e93c5ef1 call 7ff7e93b9dd0 535->538 536->538 539 7ff7e93c5f91-7ff7e93c5f9c 537->539 540 7ff7e93c5f71-7ff7e93c5f75 537->540 538->512 543 7ff7e93c5fa2-7ff7e93c5fa6 539->543 544 7ff7e93c6040 539->544 540->539 542 7ff7e93c5f77-7ff7e93c5f8c 540->542 542->539 543->544 546 7ff7e93c5fac-7ff7e93c5ff1 CloseHandle CreateFileW 543->546 544->512 547 7ff7e93c6026-7ff7e93c603b 546->547 548 7ff7e93c5ff3-7ff7e93c6021 GetLastError call 7ff7e93b4368 call 7ff7e93b7970 546->548 547->544 548->547
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.3006178811.00007FF7E93A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E93A0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006139504.00007FF7E93A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006229148.00007FF7E93CB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93DE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006337234.00007FF7E93E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff7e93a0000_1.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 1617910340-0
                                                                                                                                                                                                                            • Opcode ID: a69f399e4b06a5e248c6b703f60b2f721b94672e004abf856287656fc91ee5b6
                                                                                                                                                                                                                            • Instruction ID: a2e0d55a7882ca9b2fa16a86172e1384b45e487bd96b1c5e7631357572bf4a7d
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: a69f399e4b06a5e248c6b703f60b2f721b94672e004abf856287656fc91ee5b6
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: A9C1C137B28E4286EB10DF68C4806AC7771FB69B98B91032ADE1E97795DF38D451C321
                                                                                                                                                                                                                            Function 00007FF7E93A79B0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 89fileCOMMON
                                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • FindFirstFileW.KERNELBASE(?,00007FF7E93A7EF9,00007FF7E93A39E6), ref: 00007FF7E93A7A1B
                                                                                                                                                                                                                            • RemoveDirectoryW.KERNEL32(?,00007FF7E93A7EF9,00007FF7E93A39E6), ref: 00007FF7E93A7A9E
                                                                                                                                                                                                                            • DeleteFileW.KERNELBASE(?,00007FF7E93A7EF9,00007FF7E93A39E6), ref: 00007FF7E93A7ABD
                                                                                                                                                                                                                            • FindNextFileW.KERNELBASE(?,00007FF7E93A7EF9,00007FF7E93A39E6), ref: 00007FF7E93A7ACB
                                                                                                                                                                                                                            • FindClose.KERNELBASE(?,00007FF7E93A7EF9,00007FF7E93A39E6), ref: 00007FF7E93A7ADC
                                                                                                                                                                                                                            • RemoveDirectoryW.KERNELBASE(?,00007FF7E93A7EF9,00007FF7E93A39E6), ref: 00007FF7E93A7AE5
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.3006178811.00007FF7E93A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E93A0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006139504.00007FF7E93A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006229148.00007FF7E93CB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93DE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006337234.00007FF7E93E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff7e93a0000_1.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: FileFind$DirectoryRemove$CloseDeleteFirstNext
                                                                                                                                                                                                                            • String ID: %s\*
                                                                                                                                                                                                                            • API String ID: 1057558799-766152087
                                                                                                                                                                                                                            • Opcode ID: 28b17b752644ad79b76fdaecccd908953f702e209cd2b6248263d266171aeab9
                                                                                                                                                                                                                            • Instruction ID: 4d4a05bf40714936eb5ce158ae244b940aa20c1e29acfa7db4ed4bbaef652557
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 28b17b752644ad79b76fdaecccd908953f702e209cd2b6248263d266171aeab9
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 57418423A0C94295EA20AF64E4986B9A370FBA4754FD0013BD59E42784EF7CD646C723
                                                                                                                                                                                                                            Function 00007FF7E93C518C Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 143timeCOMMON
                                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                                            control_flow_graph 840 7ff7e93c518c-7ff7e93c51c1 call 7ff7e93c4898 call 7ff7e93c48a0 call 7ff7e93c4908 847 7ff7e93c52ff-7ff7e93c536d call 7ff7e93b9c10 call 7ff7e93c0888 840->847 848 7ff7e93c51c7-7ff7e93c51d2 call 7ff7e93c48a8 840->848 859 7ff7e93c536f-7ff7e93c5376 847->859 860 7ff7e93c537b-7ff7e93c537e 847->860 848->847 853 7ff7e93c51d8-7ff7e93c51e3 call 7ff7e93c48d8 848->853 853->847 861 7ff7e93c51e9-7ff7e93c520c call 7ff7e93b9c58 GetTimeZoneInformation 853->861 862 7ff7e93c540b-7ff7e93c540e 859->862 863 7ff7e93c5380 860->863 864 7ff7e93c53b5-7ff7e93c53c8 call 7ff7e93bc90c 860->864 873 7ff7e93c5212-7ff7e93c5233 861->873 874 7ff7e93c52d4-7ff7e93c52fe call 7ff7e93c4890 call 7ff7e93c4880 call 7ff7e93c4888 861->874 867 7ff7e93c5383 call 7ff7e93c518c 862->867 869 7ff7e93c5414-7ff7e93c541c call 7ff7e93c4f10 862->869 863->867 876 7ff7e93c53d3-7ff7e93c53ee call 7ff7e93c0888 864->876 877 7ff7e93c53ca 864->877 878 7ff7e93c5388-7ff7e93c53b4 call 7ff7e93b9c58 call 7ff7e93ab870 867->878 869->878 879 7ff7e93c5235-7ff7e93c523b 873->879 880 7ff7e93c523e-7ff7e93c5245 873->880 897 7ff7e93c53f0-7ff7e93c53f3 876->897 898 7ff7e93c53f5-7ff7e93c5407 call 7ff7e93b9c58 876->898 883 7ff7e93c53cc-7ff7e93c53d1 call 7ff7e93b9c58 877->883 879->880 886 7ff7e93c5259 880->886 887 7ff7e93c5247-7ff7e93c524f 880->887 883->863 890 7ff7e93c525b-7ff7e93c52cf call 7ff7e93c97e0 * 4 call 7ff7e93c1e6c call 7ff7e93c5424 * 2 886->890 887->886 893 7ff7e93c5251-7ff7e93c5257 887->893 890->874 893->890 897->883 898->862
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • _get_daylight.LIBCMT ref: 00007FF7E93C51BA
                                                                                                                                                                                                                              • Part of subcall function 00007FF7E93C4908: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7E93C491C
                                                                                                                                                                                                                            • _get_daylight.LIBCMT ref: 00007FF7E93C51CB
                                                                                                                                                                                                                              • Part of subcall function 00007FF7E93C48A8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7E93C48BC
                                                                                                                                                                                                                            • _get_daylight.LIBCMT ref: 00007FF7E93C51DC
                                                                                                                                                                                                                              • Part of subcall function 00007FF7E93C48D8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7E93C48EC
                                                                                                                                                                                                                              • Part of subcall function 00007FF7E93B9C58: RtlFreeHeap.NTDLL(?,?,?,00007FF7E93C2032,?,?,?,00007FF7E93C206F,?,?,00000000,00007FF7E93C2535,?,?,?,00007FF7E93C2467), ref: 00007FF7E93B9C6E
                                                                                                                                                                                                                              • Part of subcall function 00007FF7E93B9C58: GetLastError.KERNEL32(?,?,?,00007FF7E93C2032,?,?,?,00007FF7E93C206F,?,?,00000000,00007FF7E93C2535,?,?,?,00007FF7E93C2467), ref: 00007FF7E93B9C78
                                                                                                                                                                                                                            • GetTimeZoneInformation.KERNELBASE(?,?,?,?,?,?,?,?,?,00000000,?,00007FF7E93C541C), ref: 00007FF7E93C5203
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.3006178811.00007FF7E93A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E93A0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006139504.00007FF7E93A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006229148.00007FF7E93CB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93DE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006337234.00007FF7E93E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff7e93a0000_1.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: _get_daylight_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
                                                                                                                                                                                                                            • String ID: Eastern Standard Time$Eastern Summer Time
                                                                                                                                                                                                                            • API String ID: 3458911817-239921721
                                                                                                                                                                                                                            • Opcode ID: ae64d4b013316384daf219013b3406c3cfe35626df30cbdeb691f729cbc9c9de
                                                                                                                                                                                                                            • Instruction ID: 26941cfdc15f53fbd53b67dd5b71989df2703c725e49c9c3c5cbf6a79ef33ad2
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: ae64d4b013316384daf219013b3406c3cfe35626df30cbdeb691f729cbc9c9de
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 3D512F37A18A4286E720FF21D8816ADA771AB68784FC4423BDA4D87695DF3CE4418771
                                                                                                                                                                                                                            Function 00007FF7E93A85A0 Relevance: 3.0, APIs: 2, Instructions: 29COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.3006178811.00007FF7E93A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E93A0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006139504.00007FF7E93A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006229148.00007FF7E93CB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93DE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006337234.00007FF7E93E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff7e93a0000_1.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Find$CloseFileFirst
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 2295610775-0
                                                                                                                                                                                                                            • Opcode ID: ca66ee6ee850f25a53d0c9653a43f1313d0231bc46844eb151e3c2d0b1a3e355
                                                                                                                                                                                                                            • Instruction ID: f8c4ce15dc420331925c14d302c8b4fb0a3f7ade1d4b7833a8328e6f2b6ec630
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: ca66ee6ee850f25a53d0c9653a43f1313d0231bc46844eb151e3c2d0b1a3e355
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: B1F0C833A1864186F7609F60B4483A6B370AB54368F84433EDA7D02AD4CF7CD059CA11
                                                                                                                                                                                                                            Function 00007FF7E93BFBD8 Relevance: 2.0, APIs: 1, Instructions: 461COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.3006178811.00007FF7E93A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E93A0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006139504.00007FF7E93A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006229148.00007FF7E93CB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93DE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006337234.00007FF7E93E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff7e93a0000_1.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: CurrentFeaturePresentProcessProcessor
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 1010374628-0
                                                                                                                                                                                                                            • Opcode ID: 2b6c2d1e4c043c62936e9dac6caf21e199e31a345cf4845f2c7219b702089de4
                                                                                                                                                                                                                            • Instruction ID: c6929042866ac7560c66d6fb3834ea4fad4d322d6080611e06d7d03a7409df11
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 2b6c2d1e4c043c62936e9dac6caf21e199e31a345cf4845f2c7219b702089de4
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: CD02AE27A09B8640EE54BF129405379B2B1AF65B90FC5563FEE6D463D1EE3CE8408332
                                                                                                                                                                                                                            Function 00007FF7E93A18F0 Relevance: 22.9, APIs: 2, Strings: 11, Instructions: 172COMMON
                                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                                            control_flow_graph 179 7ff7e93a18f0-7ff7e93a192b call 7ff7e93a3f70 182 7ff7e93a1bc1-7ff7e93a1be5 call 7ff7e93ab870 179->182 183 7ff7e93a1931-7ff7e93a1971 call 7ff7e93a76a0 179->183 188 7ff7e93a1977-7ff7e93a1987 call 7ff7e93af9f4 183->188 189 7ff7e93a1bae-7ff7e93a1bb1 call 7ff7e93af36c 183->189 194 7ff7e93a19a1-7ff7e93a19bd call 7ff7e93af6bc 188->194 195 7ff7e93a1989-7ff7e93a199c call 7ff7e93a2760 188->195 192 7ff7e93a1bb6-7ff7e93a1bbe 189->192 192->182 200 7ff7e93a19bf-7ff7e93a19d2 call 7ff7e93a2760 194->200 201 7ff7e93a19d7-7ff7e93a19ec call 7ff7e93b4154 194->201 195->189 200->189 206 7ff7e93a1a06-7ff7e93a1a90 call 7ff7e93a1bf0 * 2 call 7ff7e93af9f4 call 7ff7e93b4170 201->206 207 7ff7e93a19ee-7ff7e93a1a01 call 7ff7e93a2760 201->207 217 7ff7e93a1a95-7ff7e93a1a9f 206->217 207->189 218 7ff7e93a1aa1-7ff7e93a1ab4 call 7ff7e93a2760 217->218 219 7ff7e93a1ab9-7ff7e93a1ad2 call 7ff7e93af6bc 217->219 218->189 224 7ff7e93a1ad4-7ff7e93a1ae7 call 7ff7e93a2760 219->224 225 7ff7e93a1aec-7ff7e93a1b08 call 7ff7e93af430 219->225 224->189 230 7ff7e93a1b0a-7ff7e93a1b16 call 7ff7e93a25f0 225->230 231 7ff7e93a1b1b-7ff7e93a1b29 225->231 230->189 231->189 233 7ff7e93a1b2f-7ff7e93a1b3e 231->233 235 7ff7e93a1b40-7ff7e93a1b46 233->235 236 7ff7e93a1b60-7ff7e93a1b6f 235->236 237 7ff7e93a1b48-7ff7e93a1b55 235->237 236->236 238 7ff7e93a1b71-7ff7e93a1b7a 236->238 237->238 239 7ff7e93a1b8f 238->239 240 7ff7e93a1b7c-7ff7e93a1b7f 238->240 242 7ff7e93a1b91-7ff7e93a1bac 239->242 240->239 241 7ff7e93a1b81-7ff7e93a1b84 240->241 241->239 243 7ff7e93a1b86-7ff7e93a1b89 241->243 242->189 242->235 243->239 244 7ff7e93a1b8b-7ff7e93a1b8d 243->244 244->242
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.3006178811.00007FF7E93A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E93A0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006139504.00007FF7E93A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006229148.00007FF7E93CB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93DE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006337234.00007FF7E93E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff7e93a0000_1.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: _fread_nolock$Message
                                                                                                                                                                                                                            • String ID: Could not allocate buffer for TOC!$Could not allocate memory for archive structure!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$MEI$calloc$fread$fseek$malloc
                                                                                                                                                                                                                            • API String ID: 677216364-3497178890
                                                                                                                                                                                                                            • Opcode ID: 0075cdc612e3e4143b2111d675f92a0a668820fe0989f8fa0ffa202338e521ab
                                                                                                                                                                                                                            • Instruction ID: 698951e8f1bcd438d47d16db8536cc4eaa996ffd1ded80a1f5f04eafb6a23370
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 0075cdc612e3e4143b2111d675f92a0a668820fe0989f8fa0ffa202338e521ab
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 2E71C633A18A8289EB20EF54D4403B9A3B1EB64784F90443BD98D47796EFBCE544C722
                                                                                                                                                                                                                            Function 00007FF7E93A15C0 Relevance: 22.9, APIs: 1, Strings: 12, Instructions: 137COMMON
                                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                                            control_flow_graph 245 7ff7e93a15c0-7ff7e93a15d1 246 7ff7e93a15d3-7ff7e93a15dc call 7ff7e93a1050 245->246 247 7ff7e93a15f7-7ff7e93a1611 call 7ff7e93a3f70 245->247 252 7ff7e93a15ee-7ff7e93a15f6 246->252 253 7ff7e93a15de-7ff7e93a15e9 call 7ff7e93a25f0 246->253 254 7ff7e93a1613-7ff7e93a163a call 7ff7e93a2760 247->254 255 7ff7e93a163b-7ff7e93a1655 call 7ff7e93a3f70 247->255 253->252 261 7ff7e93a1671-7ff7e93a1688 call 7ff7e93af9f4 255->261 262 7ff7e93a1657-7ff7e93a166c call 7ff7e93a25f0 255->262 268 7ff7e93a168a-7ff7e93a16a6 call 7ff7e93a2760 261->268 269 7ff7e93a16ab-7ff7e93a16af 261->269 267 7ff7e93a17c5-7ff7e93a17c8 call 7ff7e93af36c 262->267 275 7ff7e93a17cd-7ff7e93a17df 267->275 279 7ff7e93a17bd-7ff7e93a17c0 call 7ff7e93af36c 268->279 272 7ff7e93a16b1-7ff7e93a16bd call 7ff7e93a11f0 269->272 273 7ff7e93a16c9-7ff7e93a16e9 call 7ff7e93b4170 269->273 280 7ff7e93a16c2-7ff7e93a16c4 272->280 281 7ff7e93a170c-7ff7e93a1717 273->281 282 7ff7e93a16eb-7ff7e93a1707 call 7ff7e93a2760 273->282 279->267 280->279 285 7ff7e93a17a6-7ff7e93a17ae call 7ff7e93b415c 281->285 286 7ff7e93a171d-7ff7e93a1726 281->286 290 7ff7e93a17b3-7ff7e93a17b8 282->290 285->290 289 7ff7e93a1730-7ff7e93a1752 call 7ff7e93af6bc 286->289 294 7ff7e93a1754-7ff7e93a176c call 7ff7e93afdfc 289->294 295 7ff7e93a1785-7ff7e93a178c 289->295 290->279 301 7ff7e93a1775-7ff7e93a1783 294->301 302 7ff7e93a176e-7ff7e93a1771 294->302 296 7ff7e93a1793-7ff7e93a179c call 7ff7e93a2760 295->296 303 7ff7e93a17a1 296->303 301->296 302->289 304 7ff7e93a1773 302->304 303->285 304->303
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.3006178811.00007FF7E93A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E93A0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006139504.00007FF7E93A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006229148.00007FF7E93CB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93DE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006337234.00007FF7E93E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff7e93a0000_1.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Message
                                                                                                                                                                                                                            • String ID: Failed to create symbolic link %s!$Failed to extract %s: failed to allocate temporary buffer!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to open target file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$Failed to extract %s: failed to write data chunk!$fopen$fread$fseek$fwrite$malloc
                                                                                                                                                                                                                            • API String ID: 2030045667-1550345328
                                                                                                                                                                                                                            • Opcode ID: 090ff46c69b2da01c1e64537556fd42aface1c1647eeb206fce1d81fd9c9c04f
                                                                                                                                                                                                                            • Instruction ID: 1bd038623a586d6bbcd8612aeec0c997d068c6e49bd852bd6151c2416cd6086f
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 090ff46c69b2da01c1e64537556fd42aface1c1647eeb206fce1d81fd9c9c04f
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 8551AF63B08A4282EA10BF5198003B5A370BF64794FD4453BED0C47796EEBCE944C322
                                                                                                                                                                                                                            Function 00007FF7E93A7FC0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 89processsynchronizationCOMMON
                                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.3006178811.00007FF7E93A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E93A0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006139504.00007FF7E93A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006229148.00007FF7E93CB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93DE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006337234.00007FF7E93E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff7e93a0000_1.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Process_invalid_parameter_noinfo$ByteCharCodeCommandConsoleCreateCtrlExitHandlerInfoLineMultiObjectSingleStartupWaitWide
                                                                                                                                                                                                                            • String ID: CreateProcessW$Failed to create child process!
                                                                                                                                                                                                                            • API String ID: 2895956056-699529898
                                                                                                                                                                                                                            • Opcode ID: 2d8580ce5d81a01d0f8683f73fef31206a84e7faf833a053d17f215ed92b6c27
                                                                                                                                                                                                                            • Instruction ID: 5933dd782c2d4b16f67862a346b2cc338824ed05fd959c16899ed4368c65cd20
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 2d8580ce5d81a01d0f8683f73fef31206a84e7faf833a053d17f215ed92b6c27
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: E6410F33A08B8185DA20AF24E4553AAB3B1FBA5364F90033AE6AD47BD5DF7CD444CB51
                                                                                                                                                                                                                            Function 00007FF7E93A11F0 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 154COMMON
                                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                                            control_flow_graph 553 7ff7e93a11f0-7ff7e93a124d call 7ff7e93ab0a0 556 7ff7e93a124f-7ff7e93a1276 call 7ff7e93a25f0 553->556 557 7ff7e93a1277-7ff7e93a128f call 7ff7e93b4170 553->557 562 7ff7e93a1291-7ff7e93a12a8 call 7ff7e93a2760 557->562 563 7ff7e93a12ad-7ff7e93a12bd call 7ff7e93b4170 557->563 568 7ff7e93a1409-7ff7e93a141e call 7ff7e93aad80 call 7ff7e93b415c * 2 562->568 569 7ff7e93a12bf-7ff7e93a12d6 call 7ff7e93a2760 563->569 570 7ff7e93a12db-7ff7e93a12ed 563->570 585 7ff7e93a1423-7ff7e93a143d 568->585 569->568 572 7ff7e93a12f0-7ff7e93a1315 call 7ff7e93af6bc 570->572 579 7ff7e93a1401 572->579 580 7ff7e93a131b-7ff7e93a1325 call 7ff7e93af430 572->580 579->568 580->579 586 7ff7e93a132b-7ff7e93a1337 580->586 587 7ff7e93a1340-7ff7e93a1368 call 7ff7e93a94e0 586->587 590 7ff7e93a13e6-7ff7e93a13fc call 7ff7e93a25f0 587->590 591 7ff7e93a136a-7ff7e93a136d 587->591 590->579 592 7ff7e93a136f-7ff7e93a1379 591->592 593 7ff7e93a13e1 591->593 595 7ff7e93a13a4-7ff7e93a13a7 592->595 596 7ff7e93a137b-7ff7e93a1389 call 7ff7e93afdfc 592->596 593->590 598 7ff7e93a13ba-7ff7e93a13bf 595->598 599 7ff7e93a13a9-7ff7e93a13b7 call 7ff7e93c9140 595->599 601 7ff7e93a138e-7ff7e93a1391 596->601 598->587 600 7ff7e93a13c5-7ff7e93a13c8 598->600 599->598 603 7ff7e93a13ca-7ff7e93a13cd 600->603 604 7ff7e93a13dc-7ff7e93a13df 600->604 605 7ff7e93a139f-7ff7e93a13a2 601->605 606 7ff7e93a1393-7ff7e93a139d call 7ff7e93af430 601->606 603->590 608 7ff7e93a13cf-7ff7e93a13d7 603->608 604->579 605->590 606->598 606->605 608->572
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.3006178811.00007FF7E93A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E93A0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006139504.00007FF7E93A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006229148.00007FF7E93CB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93DE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006337234.00007FF7E93E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff7e93a0000_1.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Message
                                                                                                                                                                                                                            • String ID: 1.3.1$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$malloc
                                                                                                                                                                                                                            • API String ID: 2030045667-2813020118
                                                                                                                                                                                                                            • Opcode ID: 2899c2007e95d52ff8ee2f850961f0f2b16a6c97f5ed8b3c34e646397febbb13
                                                                                                                                                                                                                            • Instruction ID: a1b5022a8a3b2bf31f6bd8a284fcc463869323fbaa0615010e8ffa6deac5465d
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 2899c2007e95d52ff8ee2f850961f0f2b16a6c97f5ed8b3c34e646397febbb13
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: E9510623A0864281E620BF56A4403BAA2B1BF65794FC4053EED4D47BD6EF7CE541C321
                                                                                                                                                                                                                            Function 00007FF7E93BE020 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMONLIBRARYCODE
                                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • FreeLibrary.KERNEL32(?,?,?,00007FF7E93BE3BA,?,?,-00000018,00007FF7E93BA063,?,?,?,00007FF7E93B9F5A,?,?,?,00007FF7E93B524E), ref: 00007FF7E93BE19C
                                                                                                                                                                                                                            • GetProcAddress.KERNEL32(?,?,?,00007FF7E93BE3BA,?,?,-00000018,00007FF7E93BA063,?,?,?,00007FF7E93B9F5A,?,?,?,00007FF7E93B524E), ref: 00007FF7E93BE1A8
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.3006178811.00007FF7E93A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E93A0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006139504.00007FF7E93A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006229148.00007FF7E93CB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93DE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006337234.00007FF7E93E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff7e93a0000_1.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: AddressFreeLibraryProc
                                                                                                                                                                                                                            • String ID: api-ms-$ext-ms-
                                                                                                                                                                                                                            • API String ID: 3013587201-537541572
                                                                                                                                                                                                                            • Opcode ID: 400d167c79677b3a1b331b2dd1a2c4ed1cd7dec94f3cf9f9612a621c3bffedbb
                                                                                                                                                                                                                            • Instruction ID: fdd321501e5736fbfc98fc70c690c53c25b401c853bf8d222f163c8e22c9f777
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 400d167c79677b3a1b331b2dd1a2c4ed1cd7dec94f3cf9f9612a621c3bffedbb
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 7841B323B19A0241EB25AF1AE800775B3B1BF65B90F98413BDD1D57784EE3CE805C266
                                                                                                                                                                                                                            Function 00007FF7E93A7C40 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 116COMMON
                                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • GetTempPathW.KERNEL32(?,?,FFFFFFFF,00007FF7E93A3834), ref: 00007FF7E93A7CE4
                                                                                                                                                                                                                            • CreateDirectoryW.KERNELBASE(?,?,FFFFFFFF,00007FF7E93A3834), ref: 00007FF7E93A7D2C
                                                                                                                                                                                                                              • Part of subcall function 00007FF7E93A7E10: GetEnvironmentVariableW.KERNEL32(00007FF7E93A365F), ref: 00007FF7E93A7E47
                                                                                                                                                                                                                              • Part of subcall function 00007FF7E93A7E10: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF7E93A7E69
                                                                                                                                                                                                                              • Part of subcall function 00007FF7E93B7548: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7E93B7561
                                                                                                                                                                                                                              • Part of subcall function 00007FF7E93A26C0: MessageBoxW.USER32 ref: 00007FF7E93A2736
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.3006178811.00007FF7E93A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E93A0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006139504.00007FF7E93A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006229148.00007FF7E93CB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93DE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006337234.00007FF7E93E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff7e93a0000_1.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Environment$CreateDirectoryExpandMessagePathStringsTempVariable_invalid_parameter_noinfo
                                                                                                                                                                                                                            • String ID: LOADER: failed to set the TMP environment variable.$LOADER: length of teporary directory path exceeds maximum path length!$TMP$TMP$_MEI%d
                                                                                                                                                                                                                            • API String ID: 740614611-1339014028
                                                                                                                                                                                                                            • Opcode ID: e203fb9b2ed022230aea9b70073d79c64569b0fcacf7335b186391ffe1e7d089
                                                                                                                                                                                                                            • Instruction ID: 49375633769ecf74e7e101167ce91fbf4de6535702c24d3ba3be95df146e5dd8
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: e203fb9b2ed022230aea9b70073d79c64569b0fcacf7335b186391ffe1e7d089
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 71419113E09A4240EA20BF2199953F9E271AF65780FC0413BED1E57B96FE7CE9008362
                                                                                                                                                                                                                            Function 00007FF7E93BAD6C Relevance: 10.8, APIs: 7, Instructions: 290COMMONLIBRARYCODE
                                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                                            control_flow_graph 727 7ff7e93bad6c-7ff7e93bad92 728 7ff7e93bad94-7ff7e93bada8 call 7ff7e93b43d4 call 7ff7e93b43f4 727->728 729 7ff7e93badad-7ff7e93badb1 727->729 743 7ff7e93bb19e 728->743 731 7ff7e93bb187-7ff7e93bb193 call 7ff7e93b43d4 call 7ff7e93b43f4 729->731 732 7ff7e93badb7-7ff7e93badbe 729->732 750 7ff7e93bb199 call 7ff7e93b9bf0 731->750 732->731 734 7ff7e93badc4-7ff7e93badf2 732->734 734->731 737 7ff7e93badf8-7ff7e93badff 734->737 740 7ff7e93bae01-7ff7e93bae13 call 7ff7e93b43d4 call 7ff7e93b43f4 737->740 741 7ff7e93bae18-7ff7e93bae1b 737->741 740->750 746 7ff7e93bae21-7ff7e93bae27 741->746 747 7ff7e93bb183-7ff7e93bb185 741->747 748 7ff7e93bb1a1-7ff7e93bb1b8 743->748 746->747 751 7ff7e93bae2d-7ff7e93bae30 746->751 747->748 750->743 751->740 752 7ff7e93bae32-7ff7e93bae57 751->752 755 7ff7e93bae8a-7ff7e93bae91 752->755 756 7ff7e93bae59-7ff7e93bae5b 752->756 760 7ff7e93bae66-7ff7e93bae7d call 7ff7e93b43d4 call 7ff7e93b43f4 call 7ff7e93b9bf0 755->760 761 7ff7e93bae93-7ff7e93baebb call 7ff7e93bc90c call 7ff7e93b9c58 * 2 755->761 758 7ff7e93bae82-7ff7e93bae88 756->758 759 7ff7e93bae5d-7ff7e93bae64 756->759 763 7ff7e93baf08-7ff7e93baf1f 758->763 759->758 759->760 792 7ff7e93bb010 760->792 788 7ff7e93baed8-7ff7e93baf03 call 7ff7e93bb594 761->788 789 7ff7e93baebd-7ff7e93baed3 call 7ff7e93b43f4 call 7ff7e93b43d4 761->789 766 7ff7e93baf21-7ff7e93baf29 763->766 767 7ff7e93baf9a-7ff7e93bafa4 call 7ff7e93c2c2c 763->767 766->767 771 7ff7e93baf2b-7ff7e93baf2d 766->771 779 7ff7e93bafaa-7ff7e93bafbf 767->779 780 7ff7e93bb02e 767->780 771->767 776 7ff7e93baf2f-7ff7e93baf45 771->776 776->767 781 7ff7e93baf47-7ff7e93baf53 776->781 779->780 786 7ff7e93bafc1-7ff7e93bafd3 GetConsoleMode 779->786 784 7ff7e93bb033-7ff7e93bb053 ReadFile 780->784 781->767 782 7ff7e93baf55-7ff7e93baf57 781->782 782->767 787 7ff7e93baf59-7ff7e93baf71 782->787 790 7ff7e93bb059-7ff7e93bb061 784->790 791 7ff7e93bb14d-7ff7e93bb156 GetLastError 784->791 786->780 793 7ff7e93bafd5-7ff7e93bafdd 786->793 787->767 795 7ff7e93baf73-7ff7e93baf7f 787->795 788->763 789->792 790->791 797 7ff7e93bb067 790->797 800 7ff7e93bb173-7ff7e93bb176 791->800 801 7ff7e93bb158-7ff7e93bb16e call 7ff7e93b43f4 call 7ff7e93b43d4 791->801 794 7ff7e93bb013-7ff7e93bb01d call 7ff7e93b9c58 792->794 793->784 799 7ff7e93bafdf-7ff7e93bb001 ReadConsoleW 793->799 794->748 795->767 803 7ff7e93baf81-7ff7e93baf83 795->803 807 7ff7e93bb06e-7ff7e93bb083 797->807 809 7ff7e93bb022-7ff7e93bb02c 799->809 810 7ff7e93bb003 GetLastError 799->810 804 7ff7e93bb009-7ff7e93bb00b call 7ff7e93b4368 800->804 805 7ff7e93bb17c-7ff7e93bb17e 800->805 801->792 803->767 814 7ff7e93baf85-7ff7e93baf95 803->814 804->792 805->794 807->794 816 7ff7e93bb085-7ff7e93bb090 807->816 809->807 810->804 814->767 820 7ff7e93bb092-7ff7e93bb0ab call 7ff7e93ba984 816->820 821 7ff7e93bb0b7-7ff7e93bb0bf 816->821 827 7ff7e93bb0b0-7ff7e93bb0b2 820->827 824 7ff7e93bb0c1-7ff7e93bb0d3 821->824 825 7ff7e93bb13b-7ff7e93bb148 call 7ff7e93ba7c4 821->825 828 7ff7e93bb0d5 824->828 829 7ff7e93bb12e-7ff7e93bb136 824->829 825->827 827->794 830 7ff7e93bb0da-7ff7e93bb0e1 828->830 829->794 832 7ff7e93bb0e3-7ff7e93bb0e7 830->832 833 7ff7e93bb11d-7ff7e93bb128 830->833 834 7ff7e93bb103 832->834 835 7ff7e93bb0e9-7ff7e93bb0f0 832->835 833->829 837 7ff7e93bb109-7ff7e93bb119 834->837 835->834 836 7ff7e93bb0f2-7ff7e93bb0f6 835->836 836->834 838 7ff7e93bb0f8-7ff7e93bb101 836->838 837->830 839 7ff7e93bb11b 837->839 838->837 839->829
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.3006178811.00007FF7E93A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E93A0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006139504.00007FF7E93A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006229148.00007FF7E93CB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93DE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006337234.00007FF7E93E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff7e93a0000_1.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 3215553584-0
                                                                                                                                                                                                                            • Opcode ID: 7e4b6968f21da67f115f2b5899b729ebe27c21aa0167ab1df282e77588440d71
                                                                                                                                                                                                                            • Instruction ID: 7012e2159e8131a1742b03569b3f160e60cdeedf005546b35c40935f8dd0a293
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 7e4b6968f21da67f115f2b5899b729ebe27c21aa0167ab1df282e77588440d71
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 55C1D323A0CB8751E661AF1594443BDB7B1EBA0B80F95013BEA5D43791EF7CEC558322
                                                                                                                                                                                                                            Function 00007FF7E93A7B50 Relevance: 10.6, APIs: 7, Instructions: 63COMMON
                                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.3006178811.00007FF7E93A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E93A0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006139504.00007FF7E93A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006229148.00007FF7E93CB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93DE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006337234.00007FF7E93E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff7e93a0000_1.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Token$InformationProcess$CloseConvertCurrentErrorHandleLastOpenString
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 995526605-0
                                                                                                                                                                                                                            • Opcode ID: 62e4819b0c80cd137060bb94e6a3fe70b8e549ab62dcd95e051829f5e08db428
                                                                                                                                                                                                                            • Instruction ID: d5390059307c31c8ecf6ed0238932a26d0d2baf545555f3c707fcc6288058303
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 62e4819b0c80cd137060bb94e6a3fe70b8e549ab62dcd95e051829f5e08db428
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: C2212327E0CA4241EB10AF55A48432AE3B5FF957A4F90023ADA6D43BE4EFBCD4458721
                                                                                                                                                                                                                            Function 00007FF7E93A33E0 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 59COMMON
                                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • GetModuleFileNameW.KERNEL32(?,00007FF7E93A3534), ref: 00007FF7E93A3411
                                                                                                                                                                                                                              • Part of subcall function 00007FF7E93A29E0: GetLastError.KERNEL32(?,?,?,00007FF7E93A342E,?,00007FF7E93A3534), ref: 00007FF7E93A2A14
                                                                                                                                                                                                                              • Part of subcall function 00007FF7E93A29E0: FormatMessageW.KERNEL32(?,?,?,00007FF7E93A342E), ref: 00007FF7E93A2A7D
                                                                                                                                                                                                                              • Part of subcall function 00007FF7E93A29E0: MessageBoxW.USER32 ref: 00007FF7E93A2ACF
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.3006178811.00007FF7E93A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E93A0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006139504.00007FF7E93A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006229148.00007FF7E93CB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93DE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006337234.00007FF7E93E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff7e93a0000_1.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Message$ErrorFileFormatLastModuleName
                                                                                                                                                                                                                            • String ID: Failed to convert executable path to UTF-8.$Failed to obtain executable path.$Failed to resolve full path to executable %ls.$GetModuleFileNameW$\\?\
                                                                                                                                                                                                                            • API String ID: 517058245-2863816727
                                                                                                                                                                                                                            • Opcode ID: 4333ea13b7f7892cb13c7834fe0fbc8b7cb0659b0560af6bfa7ef98de9a8054c
                                                                                                                                                                                                                            • Instruction ID: 5b6ff7e059d73de80b895af6bf7de21dea8bb29707a92ec3c712984d1b2194ad
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 4333ea13b7f7892cb13c7834fe0fbc8b7cb0659b0560af6bfa7ef98de9a8054c
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 64217163B08A4291FE21BF25E8153B6D270BF68394FC0013BDA5D865E5EE7CE505C722
                                                                                                                                                                                                                            Function 00007FF7E93A8400 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 64COMMON
                                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                              • Part of subcall function 00007FF7E93A7B50: GetCurrentProcess.KERNEL32 ref: 00007FF7E93A7B70
                                                                                                                                                                                                                              • Part of subcall function 00007FF7E93A7B50: OpenProcessToken.ADVAPI32 ref: 00007FF7E93A7B83
                                                                                                                                                                                                                              • Part of subcall function 00007FF7E93A7B50: GetTokenInformation.KERNELBASE ref: 00007FF7E93A7BA8
                                                                                                                                                                                                                              • Part of subcall function 00007FF7E93A7B50: GetLastError.KERNEL32 ref: 00007FF7E93A7BB2
                                                                                                                                                                                                                              • Part of subcall function 00007FF7E93A7B50: GetTokenInformation.KERNELBASE ref: 00007FF7E93A7BF2
                                                                                                                                                                                                                              • Part of subcall function 00007FF7E93A7B50: ConvertSidToStringSidW.ADVAPI32 ref: 00007FF7E93A7C0E
                                                                                                                                                                                                                              • Part of subcall function 00007FF7E93A7B50: CloseHandle.KERNEL32 ref: 00007FF7E93A7C26
                                                                                                                                                                                                                            • LocalFree.KERNEL32(?,00007FF7E93A3814), ref: 00007FF7E93A848C
                                                                                                                                                                                                                            • LocalFree.KERNEL32(?,00007FF7E93A3814), ref: 00007FF7E93A8495
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.3006178811.00007FF7E93A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E93A0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006139504.00007FF7E93A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006229148.00007FF7E93CB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93DE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006337234.00007FF7E93E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff7e93a0000_1.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Token$FreeInformationLocalProcess$CloseConvertCurrentErrorHandleLastOpenString
                                                                                                                                                                                                                            • String ID: D:(A;;FA;;;%s)$D:(A;;FA;;;%s)(A;;FA;;;%s)$S-1-3-4$Security descriptor string length exceeds PYI_PATH_MAX!
                                                                                                                                                                                                                            • API String ID: 6828938-1529539262
                                                                                                                                                                                                                            • Opcode ID: 3b4c49a148c6d93be49ada6c8446d085e6d181d97aae771454943d90599d7390
                                                                                                                                                                                                                            • Instruction ID: 320e08929400750c5b31fe1b3c98348f890ed0a29d8e30e55d6f8fb47ebd46b4
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 3b4c49a148c6d93be49ada6c8446d085e6d181d97aae771454943d90599d7390
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 27210F33A08B4182E610BF51E4153EAA3B5FBA4780FC4443BEA5D53B96DE7CD944C761
                                                                                                                                                                                                                            Function 00007FF7E93A7530 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 81COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • CreateDirectoryW.KERNELBASE(00000000,?,00007FF7E93A324C,?,?,00007FF7E93A3964), ref: 00007FF7E93A7642
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.3006178811.00007FF7E93A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E93A0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006139504.00007FF7E93A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006229148.00007FF7E93CB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93DE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006337234.00007FF7E93E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff7e93a0000_1.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: CreateDirectory
                                                                                                                                                                                                                            • String ID: %.*s$%s%c$\
                                                                                                                                                                                                                            • API String ID: 4241100979-1685191245
                                                                                                                                                                                                                            • Opcode ID: 7bb6789f982dd078021ca405e37f28ebc21f271831f10c16ba6710f0d2331ec5
                                                                                                                                                                                                                            • Instruction ID: b628b0f2605ff065e61d5b964bf7559799ec1f4a648619c08c4889a48bd068ca
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 7bb6789f982dd078021ca405e37f28ebc21f271831f10c16ba6710f0d2331ec5
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 31310A22A19AC149EA21AF15E8507E6A274FB64BE0F80423AEE6D437C5EF7CD6018711
                                                                                                                                                                                                                            Function 00007FF7E93BC270 Relevance: 6.2, APIs: 4, Instructions: 218COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7E93BC25B), ref: 00007FF7E93BC38C
                                                                                                                                                                                                                            • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7E93BC25B), ref: 00007FF7E93BC417
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.3006178811.00007FF7E93A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E93A0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006139504.00007FF7E93A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006229148.00007FF7E93CB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93DE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006337234.00007FF7E93E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff7e93a0000_1.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: ConsoleErrorLastMode
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 953036326-0
                                                                                                                                                                                                                            • Opcode ID: 1f18d30cb6731d2276149ea46625d8d438ffcaf3b5eb5be8e43e25f336112fa7
                                                                                                                                                                                                                            • Instruction ID: 2bb21eaaefe3a0564df2420384b6bda3c77fdbbcc530043e537da3634ae8c9fb
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 1f18d30cb6731d2276149ea46625d8d438ffcaf3b5eb5be8e43e25f336112fa7
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: EA91D573E0865185F761AF6994803BDBBB0BB64B88F94413FDE4E56685EE3CD841C322
                                                                                                                                                                                                                            Function 00007FF7E93BEC9C Relevance: 6.2, APIs: 4, Instructions: 161COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.3006178811.00007FF7E93A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E93A0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006139504.00007FF7E93A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006229148.00007FF7E93CB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93DE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006337234.00007FF7E93E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff7e93a0000_1.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: _get_daylight$_isindst
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 4170891091-0
                                                                                                                                                                                                                            • Opcode ID: fe74ad9a1dfbf97a60779a6b4eb4e3da65874cecf87de461c354fefb5b69a27d
                                                                                                                                                                                                                            • Instruction ID: 6a4ab82d81857561c8ea06be10742fa3977de2430bb02dcde6ddf08a3527def4
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: fe74ad9a1dfbf97a60779a6b4eb4e3da65874cecf87de461c354fefb5b69a27d
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 3951E873F046114AEB24EF68D9557BCB7B1AB60358F90013FDD1E52AE5EF38A8018751
                                                                                                                                                                                                                            Function 00007FF7E93B4A8C Relevance: 6.1, APIs: 4, Instructions: 119pipeCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.3006178811.00007FF7E93A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E93A0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006139504.00007FF7E93A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006229148.00007FF7E93CB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93DE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006337234.00007FF7E93E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff7e93a0000_1.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: File$ErrorHandleInformationLastNamedPeekPipeType
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 2780335769-0
                                                                                                                                                                                                                            • Opcode ID: 718fa7f5777c8e54204cc1ce482321208796285246c6f4ec4faa5f67888fd59d
                                                                                                                                                                                                                            • Instruction ID: 2d51312cd19f0dc64169e0522ab4f621b2ac30f3d7b4ce163e80b2dd80a1ecc0
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 718fa7f5777c8e54204cc1ce482321208796285246c6f4ec4faa5f67888fd59d
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 97517C23A086518AEB10EF71D4543BDB7F1AB68B58F90813ADA4947788EF38D841C766
                                                                                                                                                                                                                            Function 00007FF7E93B4938 Relevance: 6.1, APIs: 4, Instructions: 90fileCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.3006178811.00007FF7E93A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E93A0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006139504.00007FF7E93A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006229148.00007FF7E93CB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93DE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006337234.00007FF7E93E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff7e93a0000_1.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: CloseCreateFileHandle_invalid_parameter_noinfo
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 1279662727-0
                                                                                                                                                                                                                            • Opcode ID: c9c3dc0ca6ff3025a18f37416ed5252826b5e2a6b8668c561ba6737191909872
                                                                                                                                                                                                                            • Instruction ID: 5c6965d37ed175545488927946b0a614349ecad646a62129213f35ffda11eebb
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: c9c3dc0ca6ff3025a18f37416ed5252826b5e2a6b8668c561ba6737191909872
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: F541B223E1878243E750AF619544379B371FBA4764F50933AE69C03BD1EF7CA8A08726
                                                                                                                                                                                                                            Function 00007FF7E93ABF5C Relevance: 4.6, APIs: 3, Instructions: 94COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.3006178811.00007FF7E93A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E93A0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006139504.00007FF7E93A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006229148.00007FF7E93CB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93DE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006337234.00007FF7E93E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff7e93a0000_1.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_release_startup_lock
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 3251591375-0
                                                                                                                                                                                                                            • Opcode ID: ad6de077e5e85da6062eb7f9cbbc4d78ec6d74eed5dabe05811f08dc52cc1ce9
                                                                                                                                                                                                                            • Instruction ID: 691119be1c63cfd355430c60452575dee95a33e976b7850ba504fc4811c3e83b
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: ad6de077e5e85da6062eb7f9cbbc4d78ec6d74eed5dabe05811f08dc52cc1ce9
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 64310523A0C64241EA54BF6494123BAA3B1AF71384FC4403FE90E4B6D3DEBCA8048277
                                                                                                                                                                                                                            Function 00007FF7E93B8D48 Relevance: 4.5, APIs: 3, Instructions: 14COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.3006178811.00007FF7E93A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E93A0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006139504.00007FF7E93A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006229148.00007FF7E93CB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93DE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006337234.00007FF7E93E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff7e93a0000_1.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Process$CurrentExitTerminate
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 1703294689-0
                                                                                                                                                                                                                            • Opcode ID: 824606f6feba241c18d37bd9947fb033388d99e3127919417550cde66a1966b4
                                                                                                                                                                                                                            • Instruction ID: abe2473991185b7ddb0c0d1bd9a444f5f66ced20bccc140f58c7cb67c437d615
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 824606f6feba241c18d37bd9947fb033388d99e3127919417550cde66a1966b4
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 24D06716B18A0687EA543F7058593B9A3355F78701FA4183FD84B06793DD3CA80D8272
                                                                                                                                                                                                                            Function 00007FF7E93AF45C Relevance: 3.2, APIs: 2, Instructions: 177COMMONLIBRARYCODE
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.3006178811.00007FF7E93A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E93A0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006139504.00007FF7E93A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006229148.00007FF7E93CB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93DE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006337234.00007FF7E93E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff7e93a0000_1.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 3215553584-0
                                                                                                                                                                                                                            • Opcode ID: 9ca15b9002a87b72fd1966d073ee072d8ab2af6885046d3198ed673a4b76404c
                                                                                                                                                                                                                            • Instruction ID: 76f603d33c7b8d631b9ebd3af9d75b001a16b1146c65c09741a6afda9f34a51e
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 9ca15b9002a87b72fd1966d073ee072d8ab2af6885046d3198ed673a4b76404c
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 3B51F967B092424AF624BE26940077AE2B1BF64BB4F94473EDD6C437E5CE7CD4808622
                                                                                                                                                                                                                            Function 00007FF7E93BB444 Relevance: 3.0, APIs: 2, Instructions: 46COMMONLIBRARYCODE
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.3006178811.00007FF7E93A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E93A0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006139504.00007FF7E93A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006229148.00007FF7E93CB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93DE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006337234.00007FF7E93E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff7e93a0000_1.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: ErrorFileLastPointer
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 2976181284-0
                                                                                                                                                                                                                            • Opcode ID: cd3a9f3ea8ef265e1697b25d2233ff7099ae2ab5e22e5ab4fa41e006c1c379b1
                                                                                                                                                                                                                            • Instruction ID: 29c952b48aa87e38ddf3bb36130e7a289110ad52d7c0912db28514964cceae5e
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: cd3a9f3ea8ef265e1697b25d2233ff7099ae2ab5e22e5ab4fa41e006c1c379b1
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 8B11C462A08B8181DA10AF25A84426AB371FB54BF4F94033AEE7D077E9DF7CD4508712
                                                                                                                                                                                                                            Function 00007FF7E93B4C34 Relevance: 3.0, APIs: 2, Instructions: 40timeCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • FileTimeToSystemTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7E93B4B49), ref: 00007FF7E93B4C67
                                                                                                                                                                                                                            • SystemTimeToTzSpecificLocalTime.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7E93B4B49), ref: 00007FF7E93B4C7D
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.3006178811.00007FF7E93A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E93A0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006139504.00007FF7E93A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006229148.00007FF7E93CB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93DE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006337234.00007FF7E93E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff7e93a0000_1.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Time$System$FileLocalSpecific
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 1707611234-0
                                                                                                                                                                                                                            • Opcode ID: 5814b874014510fcf00941fef2b2171ed045486f006683dc2ae422325307d6da
                                                                                                                                                                                                                            • Instruction ID: f11b3e57daa17f5acfd5f18eaba6c38ac6d22b86b690eb4b970db34619ba0094
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 5814b874014510fcf00941fef2b2171ed045486f006683dc2ae422325307d6da
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: D611822360C65681EA646F15E41123EF7B0FB91B65F90023BE6AD41AD4EF3CD454DB21
                                                                                                                                                                                                                            Function 00007FF7E93B9C58 Relevance: 3.0, APIs: 2, Instructions: 19memoryCOMMONLIBRARYCODE
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • RtlFreeHeap.NTDLL(?,?,?,00007FF7E93C2032,?,?,?,00007FF7E93C206F,?,?,00000000,00007FF7E93C2535,?,?,?,00007FF7E93C2467), ref: 00007FF7E93B9C6E
                                                                                                                                                                                                                            • GetLastError.KERNEL32(?,?,?,00007FF7E93C2032,?,?,?,00007FF7E93C206F,?,?,00000000,00007FF7E93C2535,?,?,?,00007FF7E93C2467), ref: 00007FF7E93B9C78
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.3006178811.00007FF7E93A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E93A0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006139504.00007FF7E93A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006229148.00007FF7E93CB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93DE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006337234.00007FF7E93E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff7e93a0000_1.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: ErrorFreeHeapLast
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 485612231-0
                                                                                                                                                                                                                            • Opcode ID: 9fa0b27d1784483699343fce5d0d8fb71a2fef38db5c10c130c8b92919593777
                                                                                                                                                                                                                            • Instruction ID: d97314f8f53e941f83943f0e2e40bf74d822882dab92f77d04b296fed0fbfddb
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 9fa0b27d1784483699343fce5d0d8fb71a2fef38db5c10c130c8b92919593777
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 9BE04F12F0864242FF047FB2A444279A1B55FB4700B84403AC90D82251EE3C6C558232
                                                                                                                                                                                                                            Function 00007FF7E93B9E68 Relevance: 2.6, APIs: 2, Instructions: 59COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • CloseHandle.KERNELBASE(?,?,?,00007FF7E93B9CE5,?,?,00000000,00007FF7E93B9D9A), ref: 00007FF7E93B9ED6
                                                                                                                                                                                                                            • GetLastError.KERNEL32(?,?,?,00007FF7E93B9CE5,?,?,00000000,00007FF7E93B9D9A), ref: 00007FF7E93B9EE0
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.3006178811.00007FF7E93A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E93A0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006139504.00007FF7E93A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006229148.00007FF7E93CB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93DE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006337234.00007FF7E93E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff7e93a0000_1.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: CloseErrorHandleLast
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 918212764-0
                                                                                                                                                                                                                            • Opcode ID: 65da2f67be20623dd6870cbeabcb199f1b77c363b63baf0d8a802715797da709
                                                                                                                                                                                                                            • Instruction ID: bbb9fc8bd98d677da7534b86d0fbed7a05ac133a8f688678fde417ea485390c2
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 65da2f67be20623dd6870cbeabcb199f1b77c363b63baf0d8a802715797da709
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 6A216513F1864241EA947B61A494379B2B29FA47A4F94423EDA2E477D1EE7CAC418323
                                                                                                                                                                                                                            Function 00007FF7E93BB1BC Relevance: 1.6, APIs: 1, Instructions: 112COMMONLIBRARYCODE
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.3006178811.00007FF7E93A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E93A0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006139504.00007FF7E93A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006229148.00007FF7E93CB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93DE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006337234.00007FF7E93E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff7e93a0000_1.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 3215553584-0
                                                                                                                                                                                                                            • Opcode ID: 164a9401b0bfd199dc8034d016670759b34e81a86d5a64e83628a5f98765227c
                                                                                                                                                                                                                            • Instruction ID: 1426e69248825f363cc7bcee33388d26ef8a27e37e83b76613b2068f48ae43c8
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 164a9401b0bfd199dc8034d016670759b34e81a86d5a64e83628a5f98765227c
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 5041B33390820587EA24AF15A54137DB3B1EB65B84F94013BDA9E876D1EF3CED02C762
                                                                                                                                                                                                                            Function 00007FF7E93A76A0 Relevance: 1.6, APIs: 1, Instructions: 85COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.3006178811.00007FF7E93A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E93A0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006139504.00007FF7E93A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006229148.00007FF7E93CB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93DE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006337234.00007FF7E93E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff7e93a0000_1.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: _fread_nolock
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 840049012-0
                                                                                                                                                                                                                            • Opcode ID: 67d5aa2157ed7f278b6610f1c277a92a8ae8c20424344dfe32f904b414dc0200
                                                                                                                                                                                                                            • Instruction ID: 8b886b4cc83c7b498c17e48ec91c0b33f3a5073bc9259e4ea9fffcfda3d5bc35
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 67d5aa2157ed7f278b6610f1c277a92a8ae8c20424344dfe32f904b414dc0200
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 07218813F0865145FA10BE1665443FAE6A1BF55BD4FC8443ADD0E07786EEBEE441C721
                                                                                                                                                                                                                            Function 00007FF7E93BAC4C Relevance: 1.6, APIs: 1, Instructions: 79COMMONLIBRARYCODE
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.3006178811.00007FF7E93A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E93A0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006139504.00007FF7E93A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006229148.00007FF7E93CB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93DE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006337234.00007FF7E93E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff7e93a0000_1.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 3215553584-0
                                                                                                                                                                                                                            • Opcode ID: 49c1b702f419c8ad0ef71248902cf9a0cc608428026b1214a1a74e14a7199740
                                                                                                                                                                                                                            • Instruction ID: 5b6d8cafe08441c76c7dc06f95eb99c4eae161a66921efcc664b40c6bb251bb7
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 49c1b702f419c8ad0ef71248902cf9a0cc608428026b1214a1a74e14a7199740
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: E5319E23A18A5292E651BF15D84937DB6B0AB70B60FC5013FDA1D833D2EE7CAC518336
                                                                                                                                                                                                                            Function 00007FF7E93B8C79 Relevance: 1.6, APIs: 1, Instructions: 61COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.3006178811.00007FF7E93A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E93A0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006139504.00007FF7E93A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006229148.00007FF7E93CB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93DE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006337234.00007FF7E93E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff7e93a0000_1.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: HandleModule$AddressFreeLibraryProc
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 3947729631-0
                                                                                                                                                                                                                            • Opcode ID: ce8bbb5f42c0c70f8d6cb0f644a2b9beff4cd55938d93e86477bcb8353de4fc0
                                                                                                                                                                                                                            • Instruction ID: 78d050f9d369c70db5eac4a45f1e8ca3f9ff03ac1a6374a799c3e5ba122ba6e1
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: ce8bbb5f42c0c70f8d6cb0f644a2b9beff4cd55938d93e86477bcb8353de4fc0
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: BA218D76A156058AEB24AF64C4403EC73B0FB54318F94063FD61C06EC5EF38E944C761
                                                                                                                                                                                                                            Function 00007FF7E93B52A4 Relevance: 1.6, APIs: 1, Instructions: 55COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.3006178811.00007FF7E93A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E93A0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006139504.00007FF7E93A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006229148.00007FF7E93CB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93DE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006337234.00007FF7E93E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff7e93a0000_1.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 3215553584-0
                                                                                                                                                                                                                            • Opcode ID: c73ce0dbb369862aa70d4e112b5ce78fdf9595fecbc559d5a15d5b25d9b89295
                                                                                                                                                                                                                            • Instruction ID: ab71ab35fed52b427a29eb42152332c140e81f35e697ce8c1901a230909094bc
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: c73ce0dbb369862aa70d4e112b5ce78fdf9595fecbc559d5a15d5b25d9b89295
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: F4118423A1D68141EE60BF51940137EF2B4AFA5B84F84453AEB4C5B796EF3CDC408762
                                                                                                                                                                                                                            Function 00007FF7E93C5664 Relevance: 1.6, APIs: 1, Instructions: 54COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.3006178811.00007FF7E93A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E93A0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006139504.00007FF7E93A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006229148.00007FF7E93CB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93DE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006337234.00007FF7E93E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff7e93a0000_1.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 3215553584-0
                                                                                                                                                                                                                            • Opcode ID: eb818cef5f83307f6059fb404af21ab2d8804f19963bc1c1518551d96bb4d1ba
                                                                                                                                                                                                                            • Instruction ID: 22b07c5361a655e62c0708957d81188f8f6fae2d8817e5b72f3fca16189a286d
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: eb818cef5f83307f6059fb404af21ab2d8804f19963bc1c1518551d96bb4d1ba
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 2F21D73360CA8186DB61AF18D48037DB2B0EBA4B94F944339E65D476D5DF3CD810CB21
                                                                                                                                                                                                                            Function 00007FF7E93AF6DC Relevance: 1.5, APIs: 1, Instructions: 48COMMONLIBRARYCODE
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.3006178811.00007FF7E93A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E93A0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006139504.00007FF7E93A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006229148.00007FF7E93CB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93DE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006337234.00007FF7E93E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff7e93a0000_1.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 3215553584-0
                                                                                                                                                                                                                            • Opcode ID: 1d48df8ff45913ef4d2fe20e3a196162e4d6dc571d0fb1b63797b01b1d6529e7
                                                                                                                                                                                                                            • Instruction ID: 724b728a22ab5dc4e19fcbd32fcadc12d64d475bafc9d709332c467985d92cfd
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 1d48df8ff45913ef4d2fe20e3a196162e4d6dc571d0fb1b63797b01b1d6529e7
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 3C01E527A0874240E904FF525901279F7B5AB65FE0F88433ADE6C03BD6DE7CD8428311
                                                                                                                                                                                                                            Function 00007FF7E93B720C Relevance: 1.5, APIs: 1, Instructions: 43COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.3006178811.00007FF7E93A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E93A0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006139504.00007FF7E93A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006229148.00007FF7E93CB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93DE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006337234.00007FF7E93E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff7e93a0000_1.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 3215553584-0
                                                                                                                                                                                                                            • Opcode ID: bb049028caba5e04dba667320418798f18563eb801bd7df1d5910388d10efff1
                                                                                                                                                                                                                            • Instruction ID: bbf5fcd67ad52c166881516ab702cccd5bfb50220f0bc03c02b090de114cec48
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: bb049028caba5e04dba667320418798f18563eb801bd7df1d5910388d10efff1
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: AE015222E0E68241FE947F55554137DB1B0EF65794F84013EFA5E46BC6EE3CEC414222
                                                                                                                                                                                                                            Function 00007FF7E93B4720 Relevance: 1.5, APIs: 1, Instructions: 21COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.3006178811.00007FF7E93A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E93A0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006139504.00007FF7E93A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006229148.00007FF7E93CB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93DE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006337234.00007FF7E93E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff7e93a0000_1.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: CriticalDeleteSection
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 166494926-0
                                                                                                                                                                                                                            • Opcode ID: 3c853316ba1bd524e081913cf00e2e02071c8bc6d568ea65afea45bf3b13cfc6
                                                                                                                                                                                                                            • Instruction ID: 87cfd9e25a8d89791260ca605bdd8315ae8c0d3f843e3bfba5405519791ec083
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 3c853316ba1bd524e081913cf00e2e02071c8bc6d568ea65afea45bf3b13cfc6
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 49F0FE56E08A0641EB10BF65D445378B2B2AFA9704FC1103BC41D42352AD3CA854C267
                                                                                                                                                                                                                            Function 00007FF7E93B7548 Relevance: 1.5, APIs: 1, Instructions: 19COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.3006178811.00007FF7E93A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E93A0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006139504.00007FF7E93A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006229148.00007FF7E93CB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93DE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006337234.00007FF7E93E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff7e93a0000_1.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 3215553584-0
                                                                                                                                                                                                                            • Opcode ID: c51c900cc97cfaa1f2463de7ded10a88eb35566439d91f89b12c497efef6b613
                                                                                                                                                                                                                            • Instruction ID: accbc13ccb3290a80ec8693e77fd2d4f3d38039d16ff88483dc26cfbbb2ba4d2
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: c51c900cc97cfaa1f2463de7ded10a88eb35566439d91f89b12c497efef6b613
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 6EE0B692E0824642FA557EA845C63B9B170DF74340FC4403BD90A06783FD3C7C549633
                                                                                                                                                                                                                            Function 00007FF7E93BDEA8 Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • HeapAlloc.KERNEL32(?,?,00000000,00007FF7E93BA63A,?,?,?,00007FF7E93B43FD,?,?,?,?,00007FF7E93B979A), ref: 00007FF7E93BDEFD
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.3006178811.00007FF7E93A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E93A0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006139504.00007FF7E93A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006229148.00007FF7E93CB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93DE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006337234.00007FF7E93E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff7e93a0000_1.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: AllocHeap
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 4292702814-0
                                                                                                                                                                                                                            • Opcode ID: a50505f3dedbf875c6adc223253d20fad35851e197ada73c0c4444ee90b671f1
                                                                                                                                                                                                                            • Instruction ID: 28e432eca8d48bdfffbadbb1e8ddb30bf4bed954170316f33876c2e9b0fac1b4
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: a50505f3dedbf875c6adc223253d20fad35851e197ada73c0c4444ee90b671f1
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 7AF04F82B0974781FE547E6158513F5A2B09FB4B41FCC403ACA1E86281FD3CEC418232
                                                                                                                                                                                                                            Function 00007FF7E93BC90C Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • HeapAlloc.KERNEL32(?,?,?,00007FF7E93AFFB0,?,?,?,00007FF7E93B161A,?,?,?,?,?,00007FF7E93B2E09), ref: 00007FF7E93BC94A
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.3006178811.00007FF7E93A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E93A0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006139504.00007FF7E93A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006229148.00007FF7E93CB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93DE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006337234.00007FF7E93E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff7e93a0000_1.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: AllocHeap
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 4292702814-0
                                                                                                                                                                                                                            • Opcode ID: b18cfb789f6bc806f768d700ed4d2a41d5d7e56d76a43a128583cd408f8141a4
                                                                                                                                                                                                                            • Instruction ID: 18d56230541e372963b716f0c93b053a11a6f2b1805da1d3de7aa6950a2997d1
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: b18cfb789f6bc806f768d700ed4d2a41d5d7e56d76a43a128583cd408f8141a4
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 79F05E03F1834785FE647E655851379B1B15FA5760F88023AD82E852C2EE3CAD408132

                                                                                                                                                                                                                            Non-executed Functions

                                                                                                                                                                                                                            Function 00007FF7E93A6EA0 Relevance: 119.3, APIs: 33, Strings: 35, Instructions: 280libraryloaderCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.3006178811.00007FF7E93A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E93A0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006139504.00007FF7E93A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006229148.00007FF7E93CB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93DE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006337234.00007FF7E93E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff7e93a0000_1.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: AddressProc
                                                                                                                                                                                                                            • String ID: Failed to get address for %hs$GetProcAddress$Tcl_Alloc$Tcl_ConditionFinalize$Tcl_ConditionNotify$Tcl_ConditionWait$Tcl_CreateInterp$Tcl_CreateObjCommand$Tcl_CreateThread$Tcl_DeleteInterp$Tcl_DoOneEvent$Tcl_EvalEx$Tcl_EvalFile$Tcl_EvalObjv$Tcl_Finalize$Tcl_FinalizeThread$Tcl_FindExecutable$Tcl_Free$Tcl_GetCurrentThread$Tcl_GetObjResult$Tcl_GetString$Tcl_GetVar2$Tcl_Init$Tcl_JoinThread$Tcl_MutexFinalize$Tcl_MutexLock$Tcl_MutexUnlock$Tcl_NewByteArrayObj$Tcl_NewStringObj$Tcl_SetVar2$Tcl_SetVar2Ex$Tcl_ThreadAlert$Tcl_ThreadQueueEvent$Tk_GetNumMainWindows$Tk_Init
                                                                                                                                                                                                                            • API String ID: 190572456-3427451314
                                                                                                                                                                                                                            • Opcode ID: ea7dfca1e90abb6d4d8c6eb1b798acaf406610e772db9aaa2d8df727af0780f5
                                                                                                                                                                                                                            • Instruction ID: 432651617417e756877515897c0433638f0e16bd8638f53d7841c11bcd2939c5
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: ea7dfca1e90abb6d4d8c6eb1b798acaf406610e772db9aaa2d8df727af0780f5
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: CCE1AF6690DF1390EA55BF15A8503B4E3B5AF24796FE4113FD82E122A4EF7CB548C232
                                                                                                                                                                                                                            Function 00007FF7E93C33BC Relevance: 24.0, APIs: 9, Strings: 4, Instructions: 1226COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.3006178811.00007FF7E93A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E93A0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006139504.00007FF7E93A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006229148.00007FF7E93CB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93DE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006337234.00007FF7E93E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff7e93a0000_1.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: _invalid_parameter_noinfo$memcpy_s$fegetenv
                                                                                                                                                                                                                            • String ID: 1#IND$1#INF$1#QNAN$1#SNAN
                                                                                                                                                                                                                            • API String ID: 808467561-2761157908
                                                                                                                                                                                                                            • Opcode ID: 006b587dceb6a8e5448b800068f928c3aefb42c20130fc8eaa47f3b19415637c
                                                                                                                                                                                                                            • Instruction ID: 7f035c54099205616531fd4346dcd2b82560e13b6a14b00857363fb1a583d780
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 006b587dceb6a8e5448b800068f928c3aefb42c20130fc8eaa47f3b19415637c
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 5AB2D473A186828BE765DF64D4447FDB7B1FB64388F80513ADA0E57B84DB38A900CB61
                                                                                                                                                                                                                            Function 00007FF7E93A9FCD Relevance: 12.0, Strings: 9, Instructions: 744COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.3006178811.00007FF7E93A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E93A0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006139504.00007FF7E93A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006229148.00007FF7E93CB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93DE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006337234.00007FF7E93E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff7e93a0000_1.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                                            • String ID: invalid bit length repeat$invalid code -- missing end-of-block$invalid code lengths set$invalid distance code$invalid distance too far back$invalid distances set$invalid literal/length code$invalid literal/lengths set$too many length or distance symbols
                                                                                                                                                                                                                            • API String ID: 0-2665694366
                                                                                                                                                                                                                            • Opcode ID: 7289e34dee421d23927a0f8f8a094fde9ef8b8d5e9feb20e52711e481e6fcba8
                                                                                                                                                                                                                            • Instruction ID: a113fbb791bf4ac2b74655a189e109e3f4b533126f98ea49d8029408ed972f0d
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 7289e34dee421d23927a0f8f8a094fde9ef8b8d5e9feb20e52711e481e6fcba8
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: A5520373A186A68BE7A49F14C458B7E7BBAFB54340F81413EE64A87780DB7DD840CB11
                                                                                                                                                                                                                            Function 00007FF7E93AC44C Relevance: 10.6, APIs: 7, Instructions: 71COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.3006178811.00007FF7E93A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E93A0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006139504.00007FF7E93A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006229148.00007FF7E93CB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93DE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006337234.00007FF7E93E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff7e93a0000_1.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 3140674995-0
                                                                                                                                                                                                                            • Opcode ID: 59201671b846c18328c4c6cdbad1e823a2b0fec8eaed916d44c3dc4e1cb48f19
                                                                                                                                                                                                                            • Instruction ID: 0231eece792a474943c909fbb544f61921f818546b9088d065b066633c00a20b
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 59201671b846c18328c4c6cdbad1e823a2b0fec8eaed916d44c3dc4e1cb48f19
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 3D313A73609B818AEB60AF64E8803EEB374FB94744F84403ADA4E47B95DF78D548C725
                                                                                                                                                                                                                            Function 00007FF7E93A29E0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 58windowCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.3006178811.00007FF7E93A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E93A0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006139504.00007FF7E93A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006229148.00007FF7E93CB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93DE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006337234.00007FF7E93E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff7e93a0000_1.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Message$ErrorFormatLast
                                                                                                                                                                                                                            • String ID: %ls%ls: %ls$<FormatMessageW failed.>$Error
                                                                                                                                                                                                                            • API String ID: 3971115935-1149178304
                                                                                                                                                                                                                            • Opcode ID: 0ded6d4e5eeb2df7dd6c32992adf891535d6bffb348d119068df09e90069f5ad
                                                                                                                                                                                                                            • Instruction ID: 6470eaf93faf9254142d375a846ceb32e10293852194803886fdf3542733d6cf
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 0ded6d4e5eeb2df7dd6c32992adf891535d6bffb348d119068df09e90069f5ad
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: C7214D73608A9182E720AF11F4503EAB3B4FB98785F90013BEA8D53A98DF7CD546CB51
                                                                                                                                                                                                                            Function 00007FF7E93B9924 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.3006178811.00007FF7E93A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E93A0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006139504.00007FF7E93A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006229148.00007FF7E93CB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93DE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006337234.00007FF7E93E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff7e93a0000_1.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 1239891234-0
                                                                                                                                                                                                                            • Opcode ID: f336cc4ee628281f12481126c86b188c106f14650002c00baa1860decbda2c10
                                                                                                                                                                                                                            • Instruction ID: c9f50892e13f6d5efd79e2da970c0374b7d5b43237473fd2080f38f4d0c16e43
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: f336cc4ee628281f12481126c86b188c106f14650002c00baa1860decbda2c10
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 69316E37608F8186DB609F25E8403AEB3B4FB98758F90013AEA8D43B55DF38D545CB21
                                                                                                                                                                                                                            Function 00007FF7E93C0B84 Relevance: 7.8, APIs: 5, Instructions: 282COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.3006178811.00007FF7E93A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E93A0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006139504.00007FF7E93A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006229148.00007FF7E93CB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93DE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006337234.00007FF7E93E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff7e93a0000_1.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: FileFindFirst_invalid_parameter_noinfo
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 2227656907-0
                                                                                                                                                                                                                            • Opcode ID: fe4d16d24a501c342f9bdefd2dbf7b3c8df5536519bece05b709b84cd6c1ed58
                                                                                                                                                                                                                            • Instruction ID: e7e642ef59eeaaf6aa82c0073eb633cd07f3d8f9d9eaac3aea3d229cbbfbdfed
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: fe4d16d24a501c342f9bdefd2dbf7b3c8df5536519bece05b709b84cd6c1ed58
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 10B1A6A7B18AD241EE60AF25D4143B9A3B1EB64BD4F84513BE95D07B85DE3CE841C332
                                                                                                                                                                                                                            Function 00007FF7E93AC330 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.3006178811.00007FF7E93A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E93A0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006139504.00007FF7E93A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006229148.00007FF7E93CB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93DE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006337234.00007FF7E93E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff7e93a0000_1.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 2933794660-0
                                                                                                                                                                                                                            • Opcode ID: 0f32e5fb6c1657f40c76225ea380b4ebd78bc5beffa0738dce661fe11625e8f4
                                                                                                                                                                                                                            • Instruction ID: ee4d63288f12517cdf80e1f1eb8fd5fa38679a8945454436b6e7f2c59c8c9ef7
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 0f32e5fb6c1657f40c76225ea380b4ebd78bc5beffa0738dce661fe11625e8f4
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 7A113A22B14F058AEB00AF60E8543A873B4FB69758F840E36DA2D467A4DF78D158C251
                                                                                                                                                                                                                            Function 00007FF7E93C2F20 Relevance: 4.8, APIs: 3, Instructions: 340COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.3006178811.00007FF7E93A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E93A0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006139504.00007FF7E93A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006229148.00007FF7E93CB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93DE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006337234.00007FF7E93E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff7e93a0000_1.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: memcpy_s
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 1502251526-0
                                                                                                                                                                                                                            • Opcode ID: b41cb84a548d2e61bdeb7bb10330278f5fecde395d7a0ce6ff99175555b28b3c
                                                                                                                                                                                                                            • Instruction ID: fd95794f1b275d4c7b91a5458cec4705ca6eb1b1ed4270d035f4f7728d9a08b5
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: b41cb84a548d2e61bdeb7bb10330278f5fecde395d7a0ce6ff99175555b28b3c
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: F1C1C273B18A8687EB24DF59A04476AF7A1F7A4B84F84813ADF4A47744DF3DE8018B50
                                                                                                                                                                                                                            Function 00007FF7E93A979B Relevance: 4.1, Strings: 3, Instructions: 397COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.3006178811.00007FF7E93A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E93A0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006139504.00007FF7E93A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006229148.00007FF7E93CB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93DE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006337234.00007FF7E93E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff7e93a0000_1.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                                            • String ID: $header crc mismatch$unknown header flags set
                                                                                                                                                                                                                            • API String ID: 0-1127688429
                                                                                                                                                                                                                            • Opcode ID: 6a55f11302ef793728786adf415505d571280719f8ef56880a9f0a37636d8ec0
                                                                                                                                                                                                                            • Instruction ID: b34fd70e664c8fce4b84ff10e98ff0ca160bd06fc6a9dabcfa3527ca63fa9fbe
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 6a55f11302ef793728786adf415505d571280719f8ef56880a9f0a37636d8ec0
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 5EF1BF73A083C58BE7A5AF05C088B3ABAFEEF64740F45553EDA4956790CBB8D840C751
                                                                                                                                                                                                                            Function 00007FF7E93C8A38 Relevance: 3.2, APIs: 2, Instructions: 227COMMONLIBRARYCODE
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.3006178811.00007FF7E93A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E93A0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006139504.00007FF7E93A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006229148.00007FF7E93CB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93DE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006337234.00007FF7E93E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff7e93a0000_1.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: ExceptionRaise_clrfp
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 15204871-0
                                                                                                                                                                                                                            • Opcode ID: 4367feba8b0fb5a89db2d79700bffb7903d016d74ce2a4ac284103265cf95646
                                                                                                                                                                                                                            • Instruction ID: a4f69718ca4d1043b0cbbfc2cfaf97c953338849dab27be82c97b78c325551df
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 4367feba8b0fb5a89db2d79700bffb7903d016d74ce2a4ac284103265cf95646
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 6CB17C77604B898BEB15CF29C8463A8BBF0F754B48F158826DB5D83BA4CB39D851C721
                                                                                                                                                                                                                            Function 00007FF7E93B2CC4 Relevance: 2.8, Strings: 2, Instructions: 350COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.3006178811.00007FF7E93A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E93A0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006139504.00007FF7E93A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006229148.00007FF7E93CB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93DE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006337234.00007FF7E93E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff7e93a0000_1.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                                            • String ID: $
                                                                                                                                                                                                                            • API String ID: 0-227171996
                                                                                                                                                                                                                            • Opcode ID: 25965de2e6678be5c8c686b25b3b835ec4bf2bfab2b797158b347abdb642f747
                                                                                                                                                                                                                            • Instruction ID: 8c4785ecf1eee7d4024b2dc7e0ea23def107a05ce87c7bda93d7851960be2a86
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 25965de2e6678be5c8c686b25b3b835ec4bf2bfab2b797158b347abdb642f747
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 3AE1AF33A0965681EB78AE29815023DB3B0FF75B48F94423EDE5E07694EF39EC418752
                                                                                                                                                                                                                            Function 00007FF7E93A95FB Relevance: 2.7, Strings: 2, Instructions: 218COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.3006178811.00007FF7E93A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E93A0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006139504.00007FF7E93A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006229148.00007FF7E93CB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93DE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006337234.00007FF7E93E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff7e93a0000_1.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                                            • String ID: incorrect header check$invalid window size
                                                                                                                                                                                                                            • API String ID: 0-900081337
                                                                                                                                                                                                                            • Opcode ID: 226024973a440a2a6261c5f164d8bafa30541a105b972a390c392a8354fe07a0
                                                                                                                                                                                                                            • Instruction ID: 2573023f32d97f9208c36bed21bfa8bb11417dfd11f9cd2386d448097498527d
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 226024973a440a2a6261c5f164d8bafa30541a105b972a390c392a8354fe07a0
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 5D91A473A182864BF7A49F14C488B3E7ABEFF54350F51413EDA4A96690CB7CE940CB12
                                                                                                                                                                                                                            Function 00007FF7E93BD200 Relevance: 2.6, Strings: 2, Instructions: 144COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.3006178811.00007FF7E93A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E93A0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006139504.00007FF7E93A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006229148.00007FF7E93CB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93DE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006337234.00007FF7E93E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff7e93a0000_1.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                                            • String ID: e+000$gfff
                                                                                                                                                                                                                            • API String ID: 0-3030954782
                                                                                                                                                                                                                            • Opcode ID: 1324d18368fb7be0dec1b44ace24e6b174879433860390047f5d35653063db2a
                                                                                                                                                                                                                            • Instruction ID: 7f2a5bf7f576db2a611c696bbcb34165f01d2673d2daff42d7017d9eea74d073
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 1324d18368fb7be0dec1b44ace24e6b174879433860390047f5d35653063db2a
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 7A515B63B1C7C586E7249E3598017ADFBA1E764B94F88923ACB6C4BAC1DE3DD840C711
                                                                                                                                                                                                                            Function 00007FF7E93BCD6C Relevance: 1.5, Strings: 1, Instructions: 254COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.3006178811.00007FF7E93A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E93A0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006139504.00007FF7E93A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006229148.00007FF7E93CB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93DE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006337234.00007FF7E93E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff7e93a0000_1.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                                            • String ID: gfffffff
                                                                                                                                                                                                                            • API String ID: 0-1523873471
                                                                                                                                                                                                                            • Opcode ID: ee332c23296b8dd3ed29fdb42bef122adb490463d0c8b601810d73b835641fc7
                                                                                                                                                                                                                            • Instruction ID: 656417c60830cb0d832396321e98200c456699f3b1e0354ce1e48e518fd44067
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: ee332c23296b8dd3ed29fdb42bef122adb490463d0c8b601810d73b835641fc7
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: BBA14763B087C686EB21DF29A0007A9BBA1EB60BC4F448037DF9D47785EA3DD901C312
                                                                                                                                                                                                                            Function 00007FF7E93B7AAC Relevance: 1.4, Strings: 1, Instructions: 177COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.3006178811.00007FF7E93A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E93A0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006139504.00007FF7E93A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006229148.00007FF7E93CB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93DE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006337234.00007FF7E93E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff7e93a0000_1.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                            • String ID: TMP
                                                                                                                                                                                                                            • API String ID: 3215553584-3125297090
                                                                                                                                                                                                                            • Opcode ID: dd4bbb8096afc2135879a6e6acc50949ef59d292da7f7bf8111e5166495e4f15
                                                                                                                                                                                                                            • Instruction ID: 85b2ebcabbee78754a873f3cc90b38f2c18966a34d2fbecd6db20136bac7f914
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: dd4bbb8096afc2135879a6e6acc50949ef59d292da7f7bf8111e5166495e4f15
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 1F517117B0864641FA64BE26991137AF2F1AF64BC4F88443EDE0E47B91FE3CE8414626
                                                                                                                                                                                                                            Function 00007FF7E93C2790 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.3006178811.00007FF7E93A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E93A0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006139504.00007FF7E93A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006229148.00007FF7E93CB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93DE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006337234.00007FF7E93E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff7e93a0000_1.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: HeapProcess
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 54951025-0
                                                                                                                                                                                                                            • Opcode ID: fe1a72d78314f5032ff6e3f3402ce84269ae1386cefa971ca0fc6f511f9bbc55
                                                                                                                                                                                                                            • Instruction ID: cf6cc9376f59934d2db00ff114251b027a5ff7a6824d7acb7e5a27540b13be08
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: fe1a72d78314f5032ff6e3f3402ce84269ae1386cefa971ca0fc6f511f9bbc55
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 4FB09221E07B86C6EE093F21AC8632862B87FA8700FE4813EC40D81320DE3C20A58722
                                                                                                                                                                                                                            Function 00007FF7E93B28C0 Relevance: .3, Instructions: 327COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.3006178811.00007FF7E93A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E93A0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006139504.00007FF7E93A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006229148.00007FF7E93CB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93DE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006337234.00007FF7E93E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff7e93a0000_1.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                                            • Opcode ID: b05403af9c31de739a9311cbf741df56ce5de8bb6a66a9cc9bcf40cf40427d0b
                                                                                                                                                                                                                            • Instruction ID: d6fc3df4013558a5c9febbc8461a9be1a7055e153eec7062a921e82b2a3cd3d6
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: b05403af9c31de739a9311cbf741df56ce5de8bb6a66a9cc9bcf40cf40427d0b
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: AED1A027A0864685EB78AE29845037DB7B1EB75B48F94433ECE0D07694EF39EC51C362
                                                                                                                                                                                                                            Function 00007FF7E93A8B20 Relevance: .3, Instructions: 287COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.3006178811.00007FF7E93A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E93A0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006139504.00007FF7E93A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006229148.00007FF7E93CB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93DE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006337234.00007FF7E93E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff7e93a0000_1.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                                            • Opcode ID: b6de572fc7ea0867e481f021e98a3cee959a95ba6dd1d6718a656c0f39a4e480
                                                                                                                                                                                                                            • Instruction ID: eca5c349e7a2995214cd0abe47c776847b87d4857c8b4b262cee586c936f8881
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: b6de572fc7ea0867e481f021e98a3cee959a95ba6dd1d6718a656c0f39a4e480
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: C9C1BF732142F14FD288EB29E4595BA73E1F7A8309BD4402BEB8747F85CA3CA414D7A1
                                                                                                                                                                                                                            Function 00007FF7E93B1F30 Relevance: .2, Instructions: 241COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.3006178811.00007FF7E93A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E93A0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006139504.00007FF7E93A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006229148.00007FF7E93CB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93DE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006337234.00007FF7E93E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff7e93a0000_1.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                                            • Opcode ID: 54646038064d7a6353eabae39e6447674b1691c16f4822fec46df2a19c6da082
                                                                                                                                                                                                                            • Instruction ID: e430e33d975f3edf0f30f39d556de32856eadddde21279f69fd6a716dd60143a
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 54646038064d7a6353eabae39e6447674b1691c16f4822fec46df2a19c6da082
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 15B16E73A0864585EB759F29C05433DBBB0E769B48FA4423ACB4E47395EF39E841C722
                                                                                                                                                                                                                            Function 00007FF7E93BD880 Relevance: .2, Instructions: 198COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.3006178811.00007FF7E93A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E93A0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006139504.00007FF7E93A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006229148.00007FF7E93CB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93DE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006337234.00007FF7E93E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff7e93a0000_1.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                                            • Opcode ID: c5cf27518f3756e107451e616d5c43acfc5497bdc9406be32d6656a2e3ee85f8
                                                                                                                                                                                                                            • Instruction ID: f61a368349e8245a0848e19b70fc45dd2154373812fbcc41758cb3d3b1e16a08
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: c5cf27518f3756e107451e616d5c43acfc5497bdc9406be32d6656a2e3ee85f8
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 118107B3A0C78146D774DF1990403A9BBA1FB65794F84423EDAAD47B89EF3CD9008B12
                                                                                                                                                                                                                            Function 00007FF7E93C5728 Relevance: .2, Instructions: 183COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.3006178811.00007FF7E93A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E93A0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006139504.00007FF7E93A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006229148.00007FF7E93CB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93DE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006337234.00007FF7E93E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff7e93a0000_1.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 3215553584-0
                                                                                                                                                                                                                            • Opcode ID: 7a9558e86fa8b462753dac68b64cf5067dc6b1cda5ab5f882eee36bb89ede29b
                                                                                                                                                                                                                            • Instruction ID: 29f18ec86bc9460408116a1d30525b0fef288da6489d47aa8dee1a38c66b3769
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 7a9558e86fa8b462753dac68b64cf5067dc6b1cda5ab5f882eee36bb89ede29b
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: C661A223F0CA9246F764AE28845437DE6A1AB607B0F94433FD65D866D1EE7DEC408632
                                                                                                                                                                                                                            Function 00007FF7E93B0C64 Relevance: .1, Instructions: 146COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.3006178811.00007FF7E93A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E93A0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006139504.00007FF7E93A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006229148.00007FF7E93CB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93DE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006337234.00007FF7E93E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff7e93a0000_1.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                                            • Opcode ID: 68a3f5aab59b2fac328bd6ba34d5b1cd1fa94c6914f84dc4a79da3b9d8ff9a98
                                                                                                                                                                                                                            • Instruction ID: 01330cb92d7165e97542727c801c7de5cd4f7da7781de241db80339ca4f5dd92
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 68a3f5aab59b2fac328bd6ba34d5b1cd1fa94c6914f84dc4a79da3b9d8ff9a98
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 725182B7A18A5186E7349F29C050328B7B0EB64B58F64413ACA4D077D9EB3AEC42C791
                                                                                                                                                                                                                            Function 00007FF7E93B1484 Relevance: .1, Instructions: 146COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.3006178811.00007FF7E93A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E93A0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006139504.00007FF7E93A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006229148.00007FF7E93CB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93DE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006337234.00007FF7E93E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff7e93a0000_1.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                                            • Opcode ID: 8e69dfdcc94a0aa650623f7423aa354004c1f2fa01d5c1268249020d4c21f447
                                                                                                                                                                                                                            • Instruction ID: c217a150615f785dd70e8a9d9e0dff8fe3d83694f2dd4ea63b0f9ad9229d4279
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 8e69dfdcc94a0aa650623f7423aa354004c1f2fa01d5c1268249020d4c21f447
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 3651B277A1865582E7249F69C044338B3B0EB65B68F68413BCE4E07796EB3AEC43C751
                                                                                                                                                                                                                            Function 00007FF7E93B1074 Relevance: .1, Instructions: 146COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.3006178811.00007FF7E93A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E93A0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006139504.00007FF7E93A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006229148.00007FF7E93CB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93DE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006337234.00007FF7E93E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff7e93a0000_1.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                                            • Opcode ID: 27099d1c67046ba5536a5c52bb1b19252402c8bb4a5167aa336477e7b6d5f807
                                                                                                                                                                                                                            • Instruction ID: b720a33b03ec32fee3c4a957bd5ecd689b60c1b9555af5a5e35cb24b865dc99d
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 27099d1c67046ba5536a5c52bb1b19252402c8bb4a5167aa336477e7b6d5f807
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 4A519037A18A5182E7249F69C044338B3B0EB65F68F64413ACE4D47796EB3AEC43C751
                                                                                                                                                                                                                            Function 00007FF7E93B0A60 Relevance: .1, Instructions: 145COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.3006178811.00007FF7E93A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E93A0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006139504.00007FF7E93A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006229148.00007FF7E93CB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93DE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006337234.00007FF7E93E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff7e93a0000_1.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                                            • Opcode ID: 3943df286285c50b07f09d339b53caaa0afa34ddfac4fad96d8a3f7ffd6ad23b
                                                                                                                                                                                                                            • Instruction ID: 10ec5f0e2b9ae8e34677384d00fa0b0e43168f91b3ef9e1e9a139aca89d6c5b7
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 3943df286285c50b07f09d339b53caaa0afa34ddfac4fad96d8a3f7ffd6ad23b
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 1A51B1B7A1865186E7349F29C050338B7B1EB64B58FA4413ACE4D17798EB3AEC43C752
                                                                                                                                                                                                                            Function 00007FF7E93B1280 Relevance: .1, Instructions: 145COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.3006178811.00007FF7E93A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E93A0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006139504.00007FF7E93A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006229148.00007FF7E93CB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93DE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006337234.00007FF7E93E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff7e93a0000_1.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                                            • Opcode ID: e734bc54909bdf7d9c6fd1772be64da5dc64d4f5bf3044a39ac3ba7850561882
                                                                                                                                                                                                                            • Instruction ID: f6711944e16a9733b320ef896000bae4db2d2292dc970c2c559eefd4b6bd06c4
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: e734bc54909bdf7d9c6fd1772be64da5dc64d4f5bf3044a39ac3ba7850561882
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 0C51D333A1865181E7249F69C04033DB7B1EB69B58FA4413ACE4C4B79AEF3AEC42C751
                                                                                                                                                                                                                            Function 00007FF7E93B0E70 Relevance: .1, Instructions: 145COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.3006178811.00007FF7E93A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E93A0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006139504.00007FF7E93A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006229148.00007FF7E93CB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93DE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006337234.00007FF7E93E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff7e93a0000_1.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                                            • Opcode ID: dc981bf603441a130e1c6ba5e96f77be0c3c60e19ec03e3d560a09712d731568
                                                                                                                                                                                                                            • Instruction ID: 0b500514fcc0b6b6073b59549bc0a6b411b5d4e3e4b8e0d756d0b5cbee0a7b2b
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: dc981bf603441a130e1c6ba5e96f77be0c3c60e19ec03e3d560a09712d731568
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: FE51DFB7A18A5586E7349F28C04033CB3B1EB64B58FA4413ACE4D57799EB3AEC42C751
                                                                                                                                                                                                                            Function 00007FF7E93B5040 Relevance: .1, Instructions: 138COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.3006178811.00007FF7E93A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E93A0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006139504.00007FF7E93A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006229148.00007FF7E93CB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93DE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006337234.00007FF7E93E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff7e93a0000_1.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                                            • Opcode ID: dde3b7cfbcf26fc8d7513faefc9a59c4b8821272907dfbb35b6db6355186da00
                                                                                                                                                                                                                            • Instruction ID: d03cffdbc1c15030b37a2bcdb8326db5660cc64028b6f983eb72eae892cd9475
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: dde3b7cfbcf26fc8d7513faefc9a59c4b8821272907dfbb35b6db6355186da00
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 7E41E553D4974A04ED959D1809107BCB6A0EF33BA0DE813BECDA9573C3ED2D6D878222
                                                                                                                                                                                                                            Function 00007FF7E93B91B0 Relevance: .1, Instructions: 126COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.3006178811.00007FF7E93A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E93A0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006139504.00007FF7E93A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006229148.00007FF7E93CB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93DE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006337234.00007FF7E93E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff7e93a0000_1.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: ErrorFreeHeapLast
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 485612231-0
                                                                                                                                                                                                                            • Opcode ID: 8d7eb27f456b44a91f9c68f162ea9965681a4a0d7ad24d9c24e3bfc258020ebf
                                                                                                                                                                                                                            • Instruction ID: 13b74023c16bb4aa0dcee4d400095db05eb791cbc0af406cd5a079efb0249a60
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 8d7eb27f456b44a91f9c68f162ea9965681a4a0d7ad24d9c24e3bfc258020ebf
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 10410663714A5481EF18DF2AD924269B3A2B758FD4B89903BDE0D97B54EE3CC8418301
                                                                                                                                                                                                                            Function 00007FF7E93B73F4 Relevance: .1, Instructions: 98COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.3006178811.00007FF7E93A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E93A0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006139504.00007FF7E93A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006229148.00007FF7E93CB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93DE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006337234.00007FF7E93E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff7e93a0000_1.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                                            • Opcode ID: 4baa1918ae36fbaba1f0c4c13332a4bc8c2fe618b431c1ec6b7f8f21172b3378
                                                                                                                                                                                                                            • Instruction ID: 7a364679c0446c16ccf99ae8c0d9c5f68b60d928386339806148353a5ca7fd75
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 4baa1918ae36fbaba1f0c4c13332a4bc8c2fe618b431c1ec6b7f8f21172b3378
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 6431B433708B8241E724AF25648023EFAE5EF94B90F94423EEA5E53B95EF3CD8118715
                                                                                                                                                                                                                            Function 00007FF7E93C8880 Relevance: .0, Instructions: 32COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.3006178811.00007FF7E93A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E93A0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006139504.00007FF7E93A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006229148.00007FF7E93CB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93DE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006337234.00007FF7E93E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff7e93a0000_1.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                                            • Opcode ID: b45f31a2a70b9ba878c3a12fffa6905b3575b51dadbfc3a0cbe7f45b87496cea
                                                                                                                                                                                                                            • Instruction ID: d19b8170cb21c30993e655da9f78ae1ae28ca2b6fbcddd8412ef05686b959f19
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: b45f31a2a70b9ba878c3a12fffa6905b3575b51dadbfc3a0cbe7f45b87496cea
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 6BF04F72A186958EDBA59F29A80272DB7E0F718380B80813EE68AC3E04D67C94608F15
                                                                                                                                                                                                                            Function 00007FF7E93AC62C Relevance: .0, Instructions: 2COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.3006178811.00007FF7E93A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E93A0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006139504.00007FF7E93A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006229148.00007FF7E93CB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93DE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006337234.00007FF7E93E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff7e93a0000_1.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                                            • Opcode ID: 84fb9023dc3cd78644239ae856a17877a0dfc2a7c85af1c48b0789cc2cde0ccb
                                                                                                                                                                                                                            • Instruction ID: 2400c569dd13d2f88dac9d66d8f6a1727098a715302189f9a039530b7e989b8c
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 84fb9023dc3cd78644239ae856a17877a0dfc2a7c85af1c48b0789cc2cde0ccb
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 61A00122918C26D4E648AF04AA50265A238BB70300B94103AD00D410A09F7CA400C232
                                                                                                                                                                                                                            Function 00007FF7E93A50B0 Relevance: 157.9, APIs: 44, Strings: 46, Instructions: 364libraryloaderCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • GetProcAddress.KERNEL32(?,00007FF7E93A5C57,?,00007FF7E93A308E), ref: 00007FF7E93A50C0
                                                                                                                                                                                                                            • GetProcAddress.KERNEL32(?,00007FF7E93A5C57,?,00007FF7E93A308E), ref: 00007FF7E93A5101
                                                                                                                                                                                                                            • GetProcAddress.KERNEL32(?,00007FF7E93A5C57,?,00007FF7E93A308E), ref: 00007FF7E93A5126
                                                                                                                                                                                                                            • GetProcAddress.KERNEL32(?,00007FF7E93A5C57,?,00007FF7E93A308E), ref: 00007FF7E93A514B
                                                                                                                                                                                                                            • GetProcAddress.KERNEL32(?,00007FF7E93A5C57,?,00007FF7E93A308E), ref: 00007FF7E93A5173
                                                                                                                                                                                                                            • GetProcAddress.KERNEL32(?,00007FF7E93A5C57,?,00007FF7E93A308E), ref: 00007FF7E93A519B
                                                                                                                                                                                                                            • GetProcAddress.KERNEL32(?,00007FF7E93A5C57,?,00007FF7E93A308E), ref: 00007FF7E93A51C3
                                                                                                                                                                                                                            • GetProcAddress.KERNEL32(?,00007FF7E93A5C57,?,00007FF7E93A308E), ref: 00007FF7E93A51EB
                                                                                                                                                                                                                            • GetProcAddress.KERNEL32(?,00007FF7E93A5C57,?,00007FF7E93A308E), ref: 00007FF7E93A5213
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.3006178811.00007FF7E93A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E93A0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006139504.00007FF7E93A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006229148.00007FF7E93CB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93DE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006337234.00007FF7E93E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff7e93a0000_1.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: AddressProc
                                                                                                                                                                                                                            • String ID: Failed to get address for %hs$GetProcAddress$PyConfig_Clear$PyConfig_InitIsolatedConfig$PyConfig_Read$PyConfig_SetBytesString$PyConfig_SetString$PyConfig_SetWideStringList$PyErr_Clear$PyErr_Fetch$PyErr_NormalizeException$PyErr_Occurred$PyErr_Print$PyErr_Restore$PyEval_EvalCode$PyImport_AddModule$PyImport_ExecCodeModule$PyImport_ImportModule$PyList_Append$PyMarshal_ReadObjectFromString$PyMem_RawFree$PyModule_GetDict$PyObject_CallFunction$PyObject_CallFunctionObjArgs$PyObject_GetAttrString$PyObject_SetAttrString$PyObject_Str$PyPreConfig_InitIsolatedConfig$PyRun_SimpleStringFlags$PyStatus_Exception$PySys_GetObject$PySys_SetObject$PyUnicode_AsUTF8$PyUnicode_Decode$PyUnicode_DecodeFSDefault$PyUnicode_FromFormat$PyUnicode_FromString$PyUnicode_Join$PyUnicode_Replace$Py_DecRef$Py_DecodeLocale$Py_ExitStatusException$Py_Finalize$Py_InitializeFromConfig$Py_IsInitialized$Py_PreInitialize
                                                                                                                                                                                                                            • API String ID: 190572456-2007157414
                                                                                                                                                                                                                            • Opcode ID: 3c804ccaf4812c993b4970aca99c844c8aa25bcf6244ab31ff714926eb913965
                                                                                                                                                                                                                            • Instruction ID: 1f366e0a7e9983b7cf5ec905e20ac1968c79764358aa905153c01a1f311647f8
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 3c804ccaf4812c993b4970aca99c844c8aa25bcf6244ab31ff714926eb913965
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: FF12636790AF0391EA55FF15AC503B8A2B0AF75751BD8193FD80E12260AF7CB558C272
                                                                                                                                                                                                                            Function 00007FF7E93A77D0 Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 115COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                              • Part of subcall function 00007FF7E93A86B0: MultiByteToWideChar.KERNEL32(?,?,?,00007FF7E93A3FA4,00000000,00007FF7E93A1925), ref: 00007FF7E93A86E9
                                                                                                                                                                                                                            • ExpandEnvironmentStringsW.KERNEL32(?,00007FF7E93A7C97,?,?,FFFFFFFF,00007FF7E93A3834), ref: 00007FF7E93A782C
                                                                                                                                                                                                                              • Part of subcall function 00007FF7E93A26C0: MessageBoxW.USER32 ref: 00007FF7E93A2736
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.3006178811.00007FF7E93A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E93A0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006139504.00007FF7E93A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006229148.00007FF7E93CB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93DE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006337234.00007FF7E93E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff7e93a0000_1.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: ByteCharEnvironmentExpandMessageMultiStringsWide
                                                                                                                                                                                                                            • String ID: %.*s$CreateDirectory$LOADER: failed to convert runtime-tmpdir to a wide string.$LOADER: failed to create runtime-tmpdir path %ls!$LOADER: failed to expand environment variables in the runtime-tmpdir.$LOADER: failed to obtain the absolute path of the runtime-tmpdir.$LOADER: runtime-tmpdir points to non-existent drive %ls (type: %d)!$\
                                                                                                                                                                                                                            • API String ID: 1662231829-930877121
                                                                                                                                                                                                                            • Opcode ID: 9eab8ee9825a9fbd44869a095635737d99e10a8ea38952c2113d32bd4c9397e1
                                                                                                                                                                                                                            • Instruction ID: 0e45c3086612f6dbf5130e2174691acdbdd92af1a76c486b9443f069126ec56c
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 9eab8ee9825a9fbd44869a095635737d99e10a8ea38952c2113d32bd4c9397e1
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 76417113E1DA4241FA60BF25D8957BAE275AFA4780FC4403FE64E42695FEBCE5048372
                                                                                                                                                                                                                            Function 00007FF7E93A20F0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 120COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.3006178811.00007FF7E93A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E93A0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006139504.00007FF7E93A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006229148.00007FF7E93CB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93DE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006337234.00007FF7E93E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff7e93a0000_1.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: MoveWindow$ObjectSelect$DrawReleaseText
                                                                                                                                                                                                                            • String ID: P%
                                                                                                                                                                                                                            • API String ID: 2147705588-2959514604
                                                                                                                                                                                                                            • Opcode ID: d5dd136cfe9f7ccbcb0fe4cae99cf14dfe1cc9f89db7d8019ba122c6a34f6d98
                                                                                                                                                                                                                            • Instruction ID: 26ca7bf94a920f8727107eada6b83b6b86a434b31d058fd7088c465b374c3902
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: d5dd136cfe9f7ccbcb0fe4cae99cf14dfe1cc9f89db7d8019ba122c6a34f6d98
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 3851C726618BA186D6349F26A4182BAF7B1F7A8B61F404126EBDE43694DF3CD045DB30
                                                                                                                                                                                                                            Function 00007FF7E93B55A0 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 493COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.3006178811.00007FF7E93A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E93A0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006139504.00007FF7E93A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006229148.00007FF7E93CB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93DE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006337234.00007FF7E93E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff7e93a0000_1.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                            • String ID: -$:$f$p$p
                                                                                                                                                                                                                            • API String ID: 3215553584-2013873522
                                                                                                                                                                                                                            • Opcode ID: 21cbc72c7e6dc269be11e21f83bf2085e3383c5e1ad4ae35147280bf7774980f
                                                                                                                                                                                                                            • Instruction ID: 541494bb53b2c9f86de7877565e0d5014dbbf4c8a65bc74142d2995a10d89a53
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 21cbc72c7e6dc269be11e21f83bf2085e3383c5e1ad4ae35147280bf7774980f
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 0E126F63A0824386FB64BF15E05437DB6B2EB60750FD4423BD699466C4FB3CED908B26
                                                                                                                                                                                                                            Function 00007FF7E93B02E8 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 475COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.3006178811.00007FF7E93A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E93A0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006139504.00007FF7E93A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006229148.00007FF7E93CB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93DE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006337234.00007FF7E93E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff7e93a0000_1.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                            • String ID: f$f$p$p$f
                                                                                                                                                                                                                            • API String ID: 3215553584-1325933183
                                                                                                                                                                                                                            • Opcode ID: 1ce7302e2fd45bb0c0c54093c0ec2c5d292275181cf657796836d36714c503ba
                                                                                                                                                                                                                            • Instruction ID: 6dac0d64065bbb996c57809c1a45dcdfcfd59f3838f1a916f5f755a47790d7b8
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 1ce7302e2fd45bb0c0c54093c0ec2c5d292275181cf657796836d36714c503ba
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: D11250A3A0D14386FB346E15E05477AF672FBA0754FC4403BD699466C8EB7CED808B62
                                                                                                                                                                                                                            Function 00007FF7E93A1050 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 111COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.3006178811.00007FF7E93A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E93A0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006139504.00007FF7E93A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006229148.00007FF7E93CB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93DE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006337234.00007FF7E93E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff7e93a0000_1.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Message
                                                                                                                                                                                                                            • String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
                                                                                                                                                                                                                            • API String ID: 2030045667-3659356012
                                                                                                                                                                                                                            • Opcode ID: f7d5517facdb68256fa98ad35d9438cc939c53926d3722c7275d1976fe7691da
                                                                                                                                                                                                                            • Instruction ID: ba1db6e8b443bceea25758d4643aaa87a138a2573e71ee0bd91526a379a4d5e2
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: f7d5517facdb68256fa98ad35d9438cc939c53926d3722c7275d1976fe7691da
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 2A417323A0864241EA20BF52A8403B6E3B1BF757C4FD4443BDD4D47796DEBCE5458722
                                                                                                                                                                                                                            Function 00007FF7E93A1440 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 100COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.3006178811.00007FF7E93A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E93A0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006139504.00007FF7E93A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006229148.00007FF7E93CB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93DE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006337234.00007FF7E93E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff7e93a0000_1.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Message
                                                                                                                                                                                                                            • String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
                                                                                                                                                                                                                            • API String ID: 2030045667-3659356012
                                                                                                                                                                                                                            • Opcode ID: 11b5632008f833dba3b4d3e185d6fc554062a169b991855f9f7df1313a65b0d5
                                                                                                                                                                                                                            • Instruction ID: 1aa96b3b6b3d5b3494e3ed907c3c4ad33ff2904162d2bbf48df03c49f638e9e7
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 11b5632008f833dba3b4d3e185d6fc554062a169b991855f9f7df1313a65b0d5
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 97418323A0864241EA20BF55A8403B6E3B0FF257D4FD4443BDE4D17A96EEBCE9418722
                                                                                                                                                                                                                            Function 00007FF7E93ADD28 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 310COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.3006178811.00007FF7E93A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E93A0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006139504.00007FF7E93A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006229148.00007FF7E93CB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93DE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006337234.00007FF7E93E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff7e93a0000_1.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
                                                                                                                                                                                                                            • String ID: csm$csm$csm
                                                                                                                                                                                                                            • API String ID: 849930591-393685449
                                                                                                                                                                                                                            • Opcode ID: 9e3578d2910a1de3a92e15cd58e24121979594cfb80c91fc1a566261b89881c5
                                                                                                                                                                                                                            • Instruction ID: 76ab98eda9c371968724025aab19911ecd452443b76cc9b1205fd3452284c092
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 9e3578d2910a1de3a92e15cd58e24121979594cfb80c91fc1a566261b89881c5
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 6DD16E33A0874186EB20AF65D4403ADB7B0FB65788F90423BEA4D57B96DF78E480C752
                                                                                                                                                                                                                            Function 00007FF7E93ACFE8 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • LoadLibraryExW.KERNEL32(?,?,?,00007FF7E93AD29A,?,?,?,00007FF7E93ACF8C,?,?,?,00007FF7E93ACB89), ref: 00007FF7E93AD06D
                                                                                                                                                                                                                            • GetLastError.KERNEL32(?,?,?,00007FF7E93AD29A,?,?,?,00007FF7E93ACF8C,?,?,?,00007FF7E93ACB89), ref: 00007FF7E93AD07B
                                                                                                                                                                                                                            • LoadLibraryExW.KERNEL32(?,?,?,00007FF7E93AD29A,?,?,?,00007FF7E93ACF8C,?,?,?,00007FF7E93ACB89), ref: 00007FF7E93AD0A5
                                                                                                                                                                                                                            • FreeLibrary.KERNEL32(?,?,?,00007FF7E93AD29A,?,?,?,00007FF7E93ACF8C,?,?,?,00007FF7E93ACB89), ref: 00007FF7E93AD113
                                                                                                                                                                                                                            • GetProcAddress.KERNEL32(?,?,?,00007FF7E93AD29A,?,?,?,00007FF7E93ACF8C,?,?,?,00007FF7E93ACB89), ref: 00007FF7E93AD11F
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.3006178811.00007FF7E93A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E93A0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006139504.00007FF7E93A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006229148.00007FF7E93CB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93DE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006337234.00007FF7E93E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff7e93a0000_1.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Library$Load$AddressErrorFreeLastProc
                                                                                                                                                                                                                            • String ID: api-ms-
                                                                                                                                                                                                                            • API String ID: 2559590344-2084034818
                                                                                                                                                                                                                            • Opcode ID: ae36e00ef30d4e956021163d7a0c1bae911f6c658fcf96311cd3d9d96979b27c
                                                                                                                                                                                                                            • Instruction ID: 2d9eede53d7de5869aafcfd06e0d306d40fabd7f1b879a4af14b137b92f761df
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: ae36e00ef30d4e956021163d7a0c1bae911f6c658fcf96311cd3d9d96979b27c
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: DA31A72261AB4185EE11EF12A800775A3B4BF25B65F99053BDD2D07344EF7CE441C326
                                                                                                                                                                                                                            Function 00007FF7E93BA460 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.3006178811.00007FF7E93A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E93A0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006139504.00007FF7E93A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006229148.00007FF7E93CB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93DE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006337234.00007FF7E93E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff7e93a0000_1.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Value$ErrorLast
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 2506987500-0
                                                                                                                                                                                                                            • Opcode ID: 55a13e5d0c2be300fd0aa5feb7cab341fb5be024435351ef1c8ee5a0da484fed
                                                                                                                                                                                                                            • Instruction ID: dab0f0d53424bd310d01e2cc30776508e9dc1b9cc26799b9a5ca6d19c428597b
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 55a13e5d0c2be300fd0aa5feb7cab341fb5be024435351ef1c8ee5a0da484fed
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: D6215122B0CA4241FA647B259659339F1B25F687A0F94063FD83E467D6ED3CAC005623
                                                                                                                                                                                                                            Function 00007FF7E93C707C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.3006178811.00007FF7E93A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E93A0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006139504.00007FF7E93A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006229148.00007FF7E93CB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93DE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006337234.00007FF7E93E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff7e93a0000_1.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
                                                                                                                                                                                                                            • String ID: CONOUT$
                                                                                                                                                                                                                            • API String ID: 3230265001-3130406586
                                                                                                                                                                                                                            • Opcode ID: 274174309ff0e3cf7757a3f5c883333dff1858e51aae267b9afc88cc39a62d3b
                                                                                                                                                                                                                            • Instruction ID: cdfa6b0a37ce02ce6ba9a5072db1f515ed980fc612ba6d778fc3ef63591b5a46
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 274174309ff0e3cf7757a3f5c883333dff1858e51aae267b9afc88cc39a62d3b
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: CC119632B18E4186E7509F12E854325A7B4FBA8BE4F90023ADE1D47794DF3CE404C761
                                                                                                                                                                                                                            Function 00007FF7E93A81F0 Relevance: 9.1, APIs: 6, Instructions: 121COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • GetCurrentProcess.KERNEL32(?,00000000,?,00007FF7E93A39F2), ref: 00007FF7E93A821D
                                                                                                                                                                                                                            • K32EnumProcessModules.KERNEL32(?,00000000,?,00007FF7E93A39F2), ref: 00007FF7E93A827A
                                                                                                                                                                                                                              • Part of subcall function 00007FF7E93A86B0: MultiByteToWideChar.KERNEL32(?,?,?,00007FF7E93A3FA4,00000000,00007FF7E93A1925), ref: 00007FF7E93A86E9
                                                                                                                                                                                                                            • K32GetModuleFileNameExW.KERNEL32(?,00000000,?,00007FF7E93A39F2), ref: 00007FF7E93A8305
                                                                                                                                                                                                                            • K32GetModuleFileNameExW.KERNEL32(?,00000000,?,00007FF7E93A39F2), ref: 00007FF7E93A8364
                                                                                                                                                                                                                            • FreeLibrary.KERNEL32(?,00000000,?,00007FF7E93A39F2), ref: 00007FF7E93A8375
                                                                                                                                                                                                                            • FreeLibrary.KERNEL32(?,00000000,?,00007FF7E93A39F2), ref: 00007FF7E93A838A
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.3006178811.00007FF7E93A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E93A0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006139504.00007FF7E93A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006229148.00007FF7E93CB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93DE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006337234.00007FF7E93E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff7e93a0000_1.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: FileFreeLibraryModuleNameProcess$ByteCharCurrentEnumModulesMultiWide
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 3462794448-0
                                                                                                                                                                                                                            • Opcode ID: 639de59220823cace7c77af6f37b7d772b01f3b75ea0781fa3cc2fa807537d27
                                                                                                                                                                                                                            • Instruction ID: 24f51859426feb356834dfdac3b6dbe526ec9a575d7ccb7db8dc934da324b0d8
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 639de59220823cace7c77af6f37b7d772b01f3b75ea0781fa3cc2fa807537d27
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 37417F77A1968241EA70AF11A4043EAB3B4FFA5B84F84413ADF6D57B85DE7CD401C721
                                                                                                                                                                                                                            Function 00007FF7E93BA5D8 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • GetLastError.KERNEL32(?,?,?,00007FF7E93B43FD,?,?,?,?,00007FF7E93B979A,?,?,?,?,00007FF7E93B649F), ref: 00007FF7E93BA5E7
                                                                                                                                                                                                                            • FlsSetValue.KERNEL32(?,?,?,00007FF7E93B43FD,?,?,?,?,00007FF7E93B979A,?,?,?,?,00007FF7E93B649F), ref: 00007FF7E93BA61D
                                                                                                                                                                                                                            • FlsSetValue.KERNEL32(?,?,?,00007FF7E93B43FD,?,?,?,?,00007FF7E93B979A,?,?,?,?,00007FF7E93B649F), ref: 00007FF7E93BA64A
                                                                                                                                                                                                                            • FlsSetValue.KERNEL32(?,?,?,00007FF7E93B43FD,?,?,?,?,00007FF7E93B979A,?,?,?,?,00007FF7E93B649F), ref: 00007FF7E93BA65B
                                                                                                                                                                                                                            • FlsSetValue.KERNEL32(?,?,?,00007FF7E93B43FD,?,?,?,?,00007FF7E93B979A,?,?,?,?,00007FF7E93B649F), ref: 00007FF7E93BA66C
                                                                                                                                                                                                                            • SetLastError.KERNEL32(?,?,?,00007FF7E93B43FD,?,?,?,?,00007FF7E93B979A,?,?,?,?,00007FF7E93B649F), ref: 00007FF7E93BA687
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.3006178811.00007FF7E93A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E93A0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006139504.00007FF7E93A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006229148.00007FF7E93CB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93DE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006337234.00007FF7E93E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff7e93a0000_1.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Value$ErrorLast
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 2506987500-0
                                                                                                                                                                                                                            • Opcode ID: 5b7c94c1c225e14586273ae0994f3fea44242cff202284b06bfee03021f35fa8
                                                                                                                                                                                                                            • Instruction ID: 1c23120f48b7ca81cc05b8b4b5ebae5638e556a729dbdf0e113148a2f7362722
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 5b7c94c1c225e14586273ae0994f3fea44242cff202284b06bfee03021f35fa8
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 72115B22B08A4242FA647F259655339B1B25F687A0F94433FD83E466D6FE3CAC018723
                                                                                                                                                                                                                            Function 00007FF7E93A2300 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 81windowCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.3006178811.00007FF7E93A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E93A0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006139504.00007FF7E93A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006229148.00007FF7E93CB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93DE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006337234.00007FF7E93E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff7e93a0000_1.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: DeleteDestroyDialogHandleIconIndirectModuleObjectParam
                                                                                                                                                                                                                            • String ID: Unhandled exception in script
                                                                                                                                                                                                                            • API String ID: 3081866767-2699770090
                                                                                                                                                                                                                            • Opcode ID: 2f02a126994589ece2bf0b221661227d336c2ada993d2ff489732679099e34b6
                                                                                                                                                                                                                            • Instruction ID: 6bd2344db0938ca1cf69da9520c987f8fb2997534b0a72d8e6a3b557be197199
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 2f02a126994589ece2bf0b221661227d336c2ada993d2ff489732679099e34b6
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 04316F63A09A8289EB20AF61E8552F9B370FB98784F80003AEA4D46B55DF3CC100C711
                                                                                                                                                                                                                            Function 00007FF7E93A2760 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 57windowCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.3006178811.00007FF7E93A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E93A0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006139504.00007FF7E93A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006229148.00007FF7E93CB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93DE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006337234.00007FF7E93E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff7e93a0000_1.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Message$ByteCharMultiWide
                                                                                                                                                                                                                            • String ID: %s%s: %s$Error$Error/warning (ANSI fallback)
                                                                                                                                                                                                                            • API String ID: 1878133881-640379615
                                                                                                                                                                                                                            • Opcode ID: c7e22cebafa3b4081381e7f20538df90bc3c47857982eb0ae5879fef5a553f49
                                                                                                                                                                                                                            • Instruction ID: 564f421df9a64f8f7c416320e925aaf0596fec0febf12833aff1f6a62c5f2609
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: c7e22cebafa3b4081381e7f20538df90bc3c47857982eb0ae5879fef5a553f49
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 85213273628A8581E620AF50F4517EAB378FFA4784F80413BEA8D03659DF7CD645C761
                                                                                                                                                                                                                            Function 00007FF7E93B8DA0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.3006178811.00007FF7E93A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E93A0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006139504.00007FF7E93A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006229148.00007FF7E93CB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93DE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006337234.00007FF7E93E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff7e93a0000_1.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: AddressFreeHandleLibraryModuleProc
                                                                                                                                                                                                                            • String ID: CorExitProcess$mscoree.dll
                                                                                                                                                                                                                            • API String ID: 4061214504-1276376045
                                                                                                                                                                                                                            • Opcode ID: f1eb0c22b123c1cdb2873c61f44d146b1d21622817f8dd4d6a21f18b4a6e3d93
                                                                                                                                                                                                                            • Instruction ID: bf7b6d4c81c455a248f929dd078e35efedb164603e9aaa50905e73335170b869
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: f1eb0c22b123c1cdb2873c61f44d146b1d21622817f8dd4d6a21f18b4a6e3d93
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: C2F04F22A19B0282EB10AF24A854379A330AF657A1FD8063FC96D465E4DF3CD449C331
                                                                                                                                                                                                                            Function 00007FF7E93C8678 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.3006178811.00007FF7E93A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E93A0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006139504.00007FF7E93A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006229148.00007FF7E93CB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93DE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006337234.00007FF7E93E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff7e93a0000_1.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: _set_statfp
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 1156100317-0
                                                                                                                                                                                                                            • Opcode ID: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
                                                                                                                                                                                                                            • Instruction ID: ea12fba1c5781457c5bbcdac87b657df0096bfa45852c0a6195e910d78617f72
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 6B11BF33E18E0301F6543928D4553F591606F74364F97063EFA6F06EE69F3CAA409232
                                                                                                                                                                                                                            Function 00007FF7E93BA6A0 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • FlsGetValue.KERNEL32(?,?,?,00007FF7E93B98B3,?,?,00000000,00007FF7E93B9B4E,?,?,?,?,?,00007FF7E93B9ADA), ref: 00007FF7E93BA6BF
                                                                                                                                                                                                                            • FlsSetValue.KERNEL32(?,?,?,00007FF7E93B98B3,?,?,00000000,00007FF7E93B9B4E,?,?,?,?,?,00007FF7E93B9ADA), ref: 00007FF7E93BA6DE
                                                                                                                                                                                                                            • FlsSetValue.KERNEL32(?,?,?,00007FF7E93B98B3,?,?,00000000,00007FF7E93B9B4E,?,?,?,?,?,00007FF7E93B9ADA), ref: 00007FF7E93BA706
                                                                                                                                                                                                                            • FlsSetValue.KERNEL32(?,?,?,00007FF7E93B98B3,?,?,00000000,00007FF7E93B9B4E,?,?,?,?,?,00007FF7E93B9ADA), ref: 00007FF7E93BA717
                                                                                                                                                                                                                            • FlsSetValue.KERNEL32(?,?,?,00007FF7E93B98B3,?,?,00000000,00007FF7E93B9B4E,?,?,?,?,?,00007FF7E93B9ADA), ref: 00007FF7E93BA728
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.3006178811.00007FF7E93A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E93A0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006139504.00007FF7E93A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006229148.00007FF7E93CB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93DE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006337234.00007FF7E93E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff7e93a0000_1.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Value
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 3702945584-0
                                                                                                                                                                                                                            • Opcode ID: 313936804f2539caa5b411e3780e1aa067584e6fc9dd7d8d0a30b7f4ad6b7a29
                                                                                                                                                                                                                            • Instruction ID: 11a9c518feaa6a96941a56008aa51d51bb0cf08853c31c418ed49cd251710a15
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 313936804f2539caa5b411e3780e1aa067584e6fc9dd7d8d0a30b7f4ad6b7a29
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 7F115E23B0C64201FA687B659556779B1B15FA83A0F88433FD87D866D6FE3CAC019622
                                                                                                                                                                                                                            Function 00007FF7E93BA534 Relevance: 7.6, APIs: 5, Instructions: 50COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.3006178811.00007FF7E93A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E93A0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006139504.00007FF7E93A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006229148.00007FF7E93CB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93DE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006337234.00007FF7E93E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff7e93a0000_1.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Value
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 3702945584-0
                                                                                                                                                                                                                            • Opcode ID: 8dbaaab3785cb5cbfef991dcb4b39f74944edf537148ee7de4100f4564720b13
                                                                                                                                                                                                                            • Instruction ID: 5fb7f5f87ac458dcee6a9d5a65da4ac26e2e608e34d43d0aa5519f8730a1a4b1
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 8dbaaab3785cb5cbfef991dcb4b39f74944edf537148ee7de4100f4564720b13
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: C9113622A0860712FA687F2544157B9B2A20F69360FC8073FD97E8A2D2FD3CBD005673
                                                                                                                                                                                                                            Function 00007FF7E93B52B0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 242COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.3006178811.00007FF7E93A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E93A0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006139504.00007FF7E93A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006229148.00007FF7E93CB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93DE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006337234.00007FF7E93E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff7e93a0000_1.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                            • String ID: verbose
                                                                                                                                                                                                                            • API String ID: 3215553584-579935070
                                                                                                                                                                                                                            • Opcode ID: f7ed0d29023b39033d3e63b48c2fcebc8df79207a036ffcb4dd83b8b3075c670
                                                                                                                                                                                                                            • Instruction ID: 5ee5656a48cb97a29d01ecd4ca71cd9222aca8c69f84c2bbe4fa95e333821cb4
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: f7ed0d29023b39033d3e63b48c2fcebc8df79207a036ffcb4dd83b8b3075c670
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: B891C023A0D64641F761AE25D45037EB6B1AB20B55FC8423BDA5E463D5FE3CEC458322
                                                                                                                                                                                                                            Function 00007FF7E93BEED8 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.3006178811.00007FF7E93A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E93A0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006139504.00007FF7E93A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006229148.00007FF7E93CB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93DE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006337234.00007FF7E93E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff7e93a0000_1.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                            • String ID: UTF-16LEUNICODE$UTF-8$ccs
                                                                                                                                                                                                                            • API String ID: 3215553584-1196891531
                                                                                                                                                                                                                            • Opcode ID: f2afffe6052eb22f88312eb2a9052de40cf8af355caad6dfb5a285a3356e609b
                                                                                                                                                                                                                            • Instruction ID: a63bd92e50dac28a6fbf89555758bf41fb69102c8409107a32ddc25bd5138d7c
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: f2afffe6052eb22f88312eb2a9052de40cf8af355caad6dfb5a285a3356e609b
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: BC81847BE0810385F6647E29C110378B6B0AB31748FD5A03FDA09972A5FA3DED859663
                                                                                                                                                                                                                            Function 00007FF7E93AC968 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 154COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.3006178811.00007FF7E93A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E93A0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006139504.00007FF7E93A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006229148.00007FF7E93CB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93DE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006337234.00007FF7E93E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff7e93a0000_1.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: CurrentImageNonwritableUnwind__except_validate_context_record
                                                                                                                                                                                                                            • String ID: csm
                                                                                                                                                                                                                            • API String ID: 2395640692-1018135373
                                                                                                                                                                                                                            • Opcode ID: 8b87fa2c553d9157ee5c92b9fa7cd74c02d8a8cd0f0d05c46c7470457ee5a2ed
                                                                                                                                                                                                                            • Instruction ID: c36bf34ec5e00ac0287bdd129ceb780eff72a1a15cdcd4dd21592843975bfdd6
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 8b87fa2c553d9157ee5c92b9fa7cd74c02d8a8cd0f0d05c46c7470457ee5a2ed
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 0851A033B196428ADB14EF15E404B79B7A1EB64B88F90813ADA4A43784DFBDE841C712
                                                                                                                                                                                                                            Function 00007FF7E93AE1F8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.3006178811.00007FF7E93A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E93A0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006139504.00007FF7E93A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006229148.00007FF7E93CB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93DE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006337234.00007FF7E93E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff7e93a0000_1.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: CallEncodePointerTranslator
                                                                                                                                                                                                                            • String ID: MOC$RCC
                                                                                                                                                                                                                            • API String ID: 3544855599-2084237596
                                                                                                                                                                                                                            • Opcode ID: 7372cc8c5436f01c7c5bf562e068c966f7e5f7c30121bdd0ddd9e56561cf3a97
                                                                                                                                                                                                                            • Instruction ID: c4133857ba6d7ed0571bd5533e0fc352818065b668348bcc639221dffa0ed69e
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 7372cc8c5436f01c7c5bf562e068c966f7e5f7c30121bdd0ddd9e56561cf3a97
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: D5618F33908B8581DB31AF15E4407AAB7B4FBA4784F44422AEB9C03B95DFBCE194CB11
                                                                                                                                                                                                                            Function 00007FF7E93AE5A8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.3006178811.00007FF7E93A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E93A0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006139504.00007FF7E93A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006229148.00007FF7E93CB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93DE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006337234.00007FF7E93E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff7e93a0000_1.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
                                                                                                                                                                                                                            • String ID: csm$csm
                                                                                                                                                                                                                            • API String ID: 3896166516-3733052814
                                                                                                                                                                                                                            • Opcode ID: 35f1ba398413474562c31f87a28067be7b3dedf2abf1bb91a394967b9293af31
                                                                                                                                                                                                                            • Instruction ID: 525bf054ac15282ebb0760b6568a2df8b275d238084190e33ca9b6eb96733441
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 35f1ba398413474562c31f87a28067be7b3dedf2abf1bb91a394967b9293af31
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: CE517033A083428AEB74AF119048368B6B0EB64B94F94453BDA5D47BD5CFBDE850CB12
                                                                                                                                                                                                                            Function 00007FF7E93A25F0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 44windowCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.3006178811.00007FF7E93A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E93A0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006139504.00007FF7E93A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006229148.00007FF7E93CB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93DE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006337234.00007FF7E93E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff7e93a0000_1.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Message$ByteCharMultiWide
                                                                                                                                                                                                                            • String ID: Error$Error/warning (ANSI fallback)
                                                                                                                                                                                                                            • API String ID: 1878133881-653037927
                                                                                                                                                                                                                            • Opcode ID: f4c9aea142df8fc367965a88b37001c6795115f60fce42f8f88369c54fa23369
                                                                                                                                                                                                                            • Instruction ID: b3afd7ffbb08fdb5ef7e7ad6f54915358058186de001e3d6b1c94258bce547b7
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: f4c9aea142df8fc367965a88b37001c6795115f60fce42f8f88369c54fa23369
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: E4118873628A8581EB20AF10E461BA9B378FB64B84FD0513BEA8D07654DF7CD609C721
                                                                                                                                                                                                                            Function 00007FF7E93A2870 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 44windowCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.3006178811.00007FF7E93A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E93A0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006139504.00007FF7E93A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006229148.00007FF7E93CB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93DE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006337234.00007FF7E93E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff7e93a0000_1.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Message$ByteCharMultiWide
                                                                                                                                                                                                                            • String ID: Error/warning (ANSI fallback)$Warning
                                                                                                                                                                                                                            • API String ID: 1878133881-2698358428
                                                                                                                                                                                                                            • Opcode ID: bedc3c020f71ec751042cc21f49bee78fdd2451348ef76e59aa444c99166d18b
                                                                                                                                                                                                                            • Instruction ID: d4d21a68b1d99ddb17b17b1c5be76294c7d0519372e77d0de4d2ae47dcf37a67
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: bedc3c020f71ec751042cc21f49bee78fdd2451348ef76e59aa444c99166d18b
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: FA118873628A8581EB20AF10F461BA9B378FB64B84F90513BDA8D47654DF7CD608C761
                                                                                                                                                                                                                            Function 00007FF7E93BB8B0 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.3006178811.00007FF7E93A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E93A0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006139504.00007FF7E93A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006229148.00007FF7E93CB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93DE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006337234.00007FF7E93E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff7e93a0000_1.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: FileWrite$ConsoleErrorLastOutput
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 2718003287-0
                                                                                                                                                                                                                            • Opcode ID: ce0c3b3fbf9f468b37350500bd40f597e2424e9246c9b6d769e6af97d5ebe549
                                                                                                                                                                                                                            • Instruction ID: 3a2113e56f4f8fd11668131becd7f1673dd75809c196ad5fd4075a9dc88f99cf
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: ce0c3b3fbf9f468b37350500bd40f597e2424e9246c9b6d769e6af97d5ebe549
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: CDD10573B08A8189E710DF79D4403AC77B5FB64798B94423ACE5E97B99EE38D806C311
                                                                                                                                                                                                                            Function 00007FF7E93A2030 Relevance: 6.1, APIs: 4, Instructions: 52COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.3006178811.00007FF7E93A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E93A0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006139504.00007FF7E93A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006229148.00007FF7E93CB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93DE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006337234.00007FF7E93E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff7e93a0000_1.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: LongWindow$DialogInvalidateRect
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 1956198572-0
                                                                                                                                                                                                                            • Opcode ID: 4b9e5de1fbcf843bc779a4d54dee57f94c26a540a6e6e96758728fc1cf1e39ca
                                                                                                                                                                                                                            • Instruction ID: 743b475536bb7b828183f66fe458fe3134097ac6c46177114a6f23687faa032f
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 4b9e5de1fbcf843bc779a4d54dee57f94c26a540a6e6e96758728fc1cf1e39ca
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 0E11AC22E0854241FA64EF59F5443799271EFA5780FD48037DE4907B9DCD7CD4C5C625
                                                                                                                                                                                                                            Function 00007FF7E93C4E2C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.3006178811.00007FF7E93A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E93A0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006139504.00007FF7E93A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006229148.00007FF7E93CB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93DE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006337234.00007FF7E93E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff7e93a0000_1.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: _get_daylight$_invalid_parameter_noinfo
                                                                                                                                                                                                                            • String ID: ?
                                                                                                                                                                                                                            • API String ID: 1286766494-1684325040
                                                                                                                                                                                                                            • Opcode ID: 90ec7c2969ce35aee26a67d6175707cb0f81e8cc9ba484ad9fb4d69d3ee99291
                                                                                                                                                                                                                            • Instruction ID: 6b6fca9bf043ceb2c055592f1478b9e9e067970e24dccb583aef9a82a29c53e4
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 90ec7c2969ce35aee26a67d6175707cb0f81e8cc9ba484ad9fb4d69d3ee99291
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 5A41E713B08B8246FB24AF25D409779E670EBA1BA4F94423EEE5C06BD5DF3CD4418722
                                                                                                                                                                                                                            Function 00007FF7E93B832C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • _invalid_parameter_noinfo.LIBCMT ref: 00007FF7E93B835E
                                                                                                                                                                                                                              • Part of subcall function 00007FF7E93B9C58: RtlFreeHeap.NTDLL(?,?,?,00007FF7E93C2032,?,?,?,00007FF7E93C206F,?,?,00000000,00007FF7E93C2535,?,?,?,00007FF7E93C2467), ref: 00007FF7E93B9C6E
                                                                                                                                                                                                                              • Part of subcall function 00007FF7E93B9C58: GetLastError.KERNEL32(?,?,?,00007FF7E93C2032,?,?,?,00007FF7E93C206F,?,?,00000000,00007FF7E93C2535,?,?,?,00007FF7E93C2467), ref: 00007FF7E93B9C78
                                                                                                                                                                                                                            • GetModuleFileNameW.KERNEL32(?,?,?,?,?,00007FF7E93ABEC5), ref: 00007FF7E93B837C
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.3006178811.00007FF7E93A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E93A0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006139504.00007FF7E93A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006229148.00007FF7E93CB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93DE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006337234.00007FF7E93E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff7e93a0000_1.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: ErrorFileFreeHeapLastModuleName_invalid_parameter_noinfo
                                                                                                                                                                                                                            • String ID: C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            • API String ID: 3580290477-851647276
                                                                                                                                                                                                                            • Opcode ID: ddc46de6380418fe35fca5e4aa859368a8c2113199f78edf785cf6db79d8d493
                                                                                                                                                                                                                            • Instruction ID: a4dbe7ee8dd285ba30ded64bbeaf2497c3809c9db18fc072cd267e9becd0e000
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: ddc46de6380418fe35fca5e4aa859368a8c2113199f78edf785cf6db79d8d493
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 1E419237A08B5285E714EF25E4812FDB3B5EB65794F95403BEA4E43B85EE3CE8418321
                                                                                                                                                                                                                            Function 00007FF7E93BF8E0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 105COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.3006178811.00007FF7E93A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E93A0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006139504.00007FF7E93A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006229148.00007FF7E93CB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93DE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006337234.00007FF7E93E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff7e93a0000_1.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: CurrentDirectory_invalid_parameter_noinfo
                                                                                                                                                                                                                            • String ID: .$:
                                                                                                                                                                                                                            • API String ID: 2020911589-4202072812
                                                                                                                                                                                                                            • Opcode ID: bf9ee131d37d8d4b56740d706dbe3ac3a60106336d17689985ebb71592200164
                                                                                                                                                                                                                            • Instruction ID: 98b85e6eb03e548065fcb0a93731b03ab66ed7d82c09453cecb3283992e663b2
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: bf9ee131d37d8d4b56740d706dbe3ac3a60106336d17689985ebb71592200164
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: F2414F27F08B5298FB10BFB198503BC76B56F24758F94103ADE4D57B45EF3899818326
                                                                                                                                                                                                                            Function 00007FF7E93BBF48 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.3006178811.00007FF7E93A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E93A0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006139504.00007FF7E93A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006229148.00007FF7E93CB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93DE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006337234.00007FF7E93E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff7e93a0000_1.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: ErrorFileLastWrite
                                                                                                                                                                                                                            • String ID: U
                                                                                                                                                                                                                            • API String ID: 442123175-4171548499
                                                                                                                                                                                                                            • Opcode ID: 0b7df1583adeec31525a7cba2b12c3ee68d62bc9877546cbea7757f0bce6ed29
                                                                                                                                                                                                                            • Instruction ID: 2dd1ab0b7cae3628e9a73d0714cbce42bf9db1ec032cd5d67ba8edc7f7d5c32b
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 0b7df1583adeec31525a7cba2b12c3ee68d62bc9877546cbea7757f0bce6ed29
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 6541B423A18A8582DB20AF25E4443A9B770FBA8794F904036EE4D87788EF7CD441CB51
                                                                                                                                                                                                                            Function 00007FF7E93BE8C8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.3006178811.00007FF7E93A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E93A0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006139504.00007FF7E93A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006229148.00007FF7E93CB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93DE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006337234.00007FF7E93E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff7e93a0000_1.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: CurrentDirectory
                                                                                                                                                                                                                            • String ID: :
                                                                                                                                                                                                                            • API String ID: 1611563598-336475711
                                                                                                                                                                                                                            • Opcode ID: 42aabba90d01c53827fde20447a69e74228e2fd19b34bc9bc36161037011c97c
                                                                                                                                                                                                                            • Instruction ID: 6c6c5ec43d2e6ae9eb6a86129667e0410e49b834068a26e169cb7728c80c0aaa
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 42aabba90d01c53827fde20447a69e74228e2fd19b34bc9bc36161037011c97c
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: D2219323A0868181EB60AF19D04437DB3B2FBA4B84FD5413BD68D43684EF7CD949C6A2
                                                                                                                                                                                                                            Function 00007FF7E93AF068 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.3006178811.00007FF7E93A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E93A0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006139504.00007FF7E93A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006229148.00007FF7E93CB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93DE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006337234.00007FF7E93E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff7e93a0000_1.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: ExceptionFileHeaderRaise
                                                                                                                                                                                                                            • String ID: csm
                                                                                                                                                                                                                            • API String ID: 2573137834-1018135373
                                                                                                                                                                                                                            • Opcode ID: 353d784395b77eefcba7ec404c7e4e47dbaba59ece92a9373595b893a828088a
                                                                                                                                                                                                                            • Instruction ID: f8df3803c2f345b1b9ca9d5ab9aef02c96989607d96528625d83193dc821cb54
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 353d784395b77eefcba7ec404c7e4e47dbaba59ece92a9373595b893a828088a
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 02114936618B8482EB619F25F44026AB7F4FB98B84F984236DA8D07768DF7CC551CB10
                                                                                                                                                                                                                            Function 00007FF7E93BFA4C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.3006178811.00007FF7E93A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E93A0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006139504.00007FF7E93A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006229148.00007FF7E93CB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93DE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006269035.00007FF7E93E4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.3006337234.00007FF7E93E6000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff7e93a0000_1.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: DriveType_invalid_parameter_noinfo
                                                                                                                                                                                                                            • String ID: :
                                                                                                                                                                                                                            • API String ID: 2595371189-336475711
                                                                                                                                                                                                                            • Opcode ID: 229dc5225c97c31120184e1c5c073253f760aebc87e6502baf4f3d3b6f3e4c47
                                                                                                                                                                                                                            • Instruction ID: efa39b0e9d362866bb2b6f0aa94d40ad5a7729d1ad6d4f28f0c6a903c99e5961
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 229dc5225c97c31120184e1c5c073253f760aebc87e6502baf4f3d3b6f3e4c47
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 03017C2791824686EB64BF60946137EB7B0EF68708FC4103BD54D82691EE7CE954CA27

                                                                                                                                                                                                                            Executed Functions

                                                                                                                                                                                                                            Function 00007FFD326833B5 Relevance: .0, Instructions: 49COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000001D.00000002.2345568242.00007FFD32680000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD32680000, based on PE: false
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_29_2_7ffd32680000_powershell.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                                            • Opcode ID: 582908582f657131c1f04ed76f34d09c60f6b2c2f8b724a61ceffa3ac25bcdd6
                                                                                                                                                                                                                            • Instruction ID: 66fc0fa9df1185c32bd570e66dde34a7a0d4bbd365bad848ffbc6b4b76d8419a
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 582908582f657131c1f04ed76f34d09c60f6b2c2f8b724a61ceffa3ac25bcdd6
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 4101677121CB0C4FD744EF4CE451AA5B7E0FB95364F10056DE58AC3651DA36E892CB45

                                                                                                                                                                                                                            Executed Functions

                                                                                                                                                                                                                            Function 00007FFD326633B5 Relevance: .0, Instructions: 49COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000001F.00000002.2421948557.00007FFD32660000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD32660000, based on PE: false
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_31_2_7ffd32660000_powershell.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                                            • Opcode ID: 08da065673a25bdeb927b4c2f952ba14616e05d90be0e25124618a69153761d0
                                                                                                                                                                                                                            • Instruction ID: ab34e74d989630a941fd029d55d4dee6b1bba0fc430a0b886c9c39354d527946
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 08da065673a25bdeb927b4c2f952ba14616e05d90be0e25124618a69153761d0
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 6D01A73020CB0C4FD744EF0CE051AA6B3E0FB95324F10056DE58AC3651DA32E882CB41